Weaponized CVE-2026

Gbhackers •Mayura Kathir • April 17, 2026

Attackers are rapidly exploiting CVE-2026-39987 in the marimo Python notebook platform to deploy a new NKAbuse backdoor variant hosted on Hugging Face Spaces, turning AI/ML developer environments into high‑value infection points. The campaign combines pre-auth RCE, credential theft, lateral movement to PostgreSQL and Redis, and a blockchain-based C2 channel that is difficult to monitor or […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit CVE-2026-39987 to Deploy NKAbuse Malware via Hugging Face A critical vulnerability in the marimo Python notebook platform, tracked as CVE-2026-39987, has been actively exploited to deploy a new variant of NKAbuse malware. The flaw allows for remote code execution without authentication, enabling attackers to leverage Hugging Face Spaces for malware distribution. Exploitation began shortly after the vulnerability was disclosed on April 9, 2026, with attacks reported as early as April 11. Sysdig's research identified 11 unique IP addresses from 10 countries conducting 662 exploit events, including credential theft and lateral movement to PostgreSQL and Redis databases. The malware, which utilizes the NKN blockchain for command and control, poses a significant threat to developer environments. Attackers have employed various techniques, including typosquatting legitimate applications and using dropper scripts to install malware. The situation remains dynamic, with ongoing monitoring and evolving tactics observed among threat actors. 5 sources 73

Extracted Entities

Weaponized CVE-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Malware (1)

MITRE ATT&CK (4)

Platforms (3)