Google is enhancing the security of its Pixel smartphones by focusing on the cellular baseband modem, which is responsible for mobile network communication. In the previous Pixel 9 model, the company implemented measures to mitigate memory-related vulnerabilities. With the upcoming Pixel 10, Google is taking further steps by incorporating a DNS parser built in the Rust programming language into the modem firmware. This change aims to bolster the device's defenses against potential exploitation of the modem, which can process external data. By addressing these vulnerabilities, Google is working to protect users from possible attacks that could compromise their devices through the modem interface.
In a recent interview, Art Manion from Tharros discussed the ongoing issues with vulnerability data across various repositories. He pointed out that many systems are not set up to effectively collect or manage this data, which leads to inconsistencies and a lack of trust. Manion introduced the concept of Minimum Viable Vulnerability Enumeration (MVVE), which aims to identify the essential assertions needed to confirm that two systems are describing the same vulnerability. However, he noted that there is no universal minimum set of assertions, as they can vary based on the specific case and change over time. This inconsistency is a significant barrier to improving the quality of vulnerability data, affecting the ability of organizations to accurately assess and respond to security risks.
A serious vulnerability in Marimo software has come to light, allowing attackers to execute remote code without needing authentication. This flaw is currently being exploited to steal user credentials, making it a pressing issue for organizations using this software. The nature of the vulnerability means that it could potentially affect a wide range of users and systems that rely on Marimo. Companies need to act quickly to protect their data and systems from unauthorized access. Immediate action is essential to mitigate the risk posed by this vulnerability as attackers are actively targeting it.
CVE-2026-39987: Marimo RCE exploited in hours after disclosure
Security Affairs
Actively Exploited
A serious vulnerability in the open-source Python notebook tool Marimo, identified as CVE-2026-39987, has been exploited within just 10 hours of its disclosure on April 8, 2026. This flaw has a CVSS score of 9.3, indicating its severity and potential impact. Researchers from the Sysdig Threat Research Team reported that attackers began exploiting this vulnerability almost immediately, raising alarms about the security of systems using Marimo. This incident underscores the urgency for users and organizations relying on this tool to take immediate action to protect their systems from potential breaches. Quick exploitation of such vulnerabilities demonstrates the need for timely patching and awareness in the cybersecurity community.
ChipSoft, a prominent Dutch healthcare IT firm, experienced a ransomware attack that led to the shutdown of its HiX platform, impacting numerous hospitals and healthcare providers across the Netherlands and Belgium. This incident has disrupted access to electronic health records (EHR) for both medical staff and patients, raising concerns about patient care and data security. As a major provider of EHR systems, ChipSoft's services are critical for managing patient information and facilitating healthcare operations. The attack underscores the vulnerability of healthcare systems to cyber threats, which can have serious implications for patient safety and operational continuity. Authorities and healthcare organizations are now tasked with addressing the fallout and restoring services as quickly as possible.
Juniper Networks has released patches for multiple vulnerabilities in its Junos OS, including a critical flaw that could allow attackers to remotely take control of affected devices without needing authentication. This vulnerability poses a serious risk to organizations using Junos OS, as it could lead to unauthorized access and potential data breaches. The company has not specified which specific products are affected, but users of Junos OS should prioritize applying these updates. The presence of such a critical flaw emphasizes the need for regular software updates and vigilance in network security practices. Companies relying on Junos OS are encouraged to check for the latest patches and ensure they are implemented promptly to mitigate the risks associated with these vulnerabilities.
A serious vulnerability in Marimo, an open-source Python notebook designed for data science, has been exploited within just 10 hours of being made public. The flaw, identified as CVE-2026-39987, allows attackers to execute remote code without needing authentication, affecting all versions of Marimo up to and including the latest release. Researchers from Sysdig reported this rapid exploitation, underscoring the urgency for users to address this security gap. Organizations using Marimo need to prioritize patching their installations to avoid potential breaches, as the high CVSS score of 9.3 indicates a significant risk. The swift exploitation of this vulnerability serves as a reminder of the importance of timely updates and security practices in software development.
In December 2025, hackers successfully breached Eurail's systems, resulting in the theft of personal information belonging to 308,777 travelers. The compromised data includes names and passport numbers, raising significant concerns about potential identity theft and the misuse of sensitive information. Eurail is now in the process of notifying those affected by the breach, emphasizing the urgent need for vigilance among individuals whose data may be at risk. This incident underscores the ongoing vulnerability of companies to cyberattacks and the importance of implementing stronger security measures to protect customer information.
A recently patched vulnerability in the EngageLab SDK, a third-party software development kit used in many Android applications, has potentially exposed the private data of around 50 million users, including 30 million cryptocurrency wallet holders. The flaw allowed apps on the same device to bypass Android's security measures, enabling unauthorized access to sensitive information. This incident raises significant concerns about the security of users' cryptocurrency assets, as the compromised data could have led to theft or fraud. Developers using the EngageLab SDK are urged to update their applications to protect users from potential attacks. The vulnerability was identified and addressed, but users should remain vigilant about app permissions and security practices.
Hackread – Cybersecurity News, Data Breaches, AI and More
LayerX researchers have found a way to exploit the Claude Code system by manipulating the CLAUDE.md file. This method allows attackers to bypass the platform's safety features, enabling them to execute SQL injection attacks. Such vulnerabilities can lead to unauthorized access to databases, potentially exposing sensitive information. This issue affects users of Claude Code, which is used in various applications for coding assistance. Companies relying on this technology should be aware of the risks and implement necessary precautions to protect their systems from possible exploitation.
Researchers at RSAC discovered a way to bypass Apple Intelligence's AI guardrails using techniques called Neural Exect and Unicode manipulation. This vulnerability could allow attackers to exploit the AI's systems, potentially leading to unauthorized access or misuse of the technology. The implications of this breach are significant, as it raises concerns about the security and reliability of AI systems used by Apple and possibly other tech companies. Users and developers relying on Apple Intelligence need to be aware of this vulnerability to ensure their systems are secure. The researchers' findings emphasize the importance of ongoing scrutiny and improvement of AI security measures.
Researchers from Cisco Talos have found that attackers are exploiting the email notification systems of popular SaaS platforms like GitHub and Jira to distribute phishing and spam emails. By sending these malicious emails from the platforms' own servers, the attackers bypass standard email security measures such as SPF, DKIM, and DMARC. This tactic allows them to deliver phishing messages that appear legitimate, effectively tricking users into engaging with the content. This incident raises serious concerns for organizations using these platforms, as it highlights a potential vulnerability in their email communication processes. Users of GitHub and Jira should be particularly vigilant about unexpected emails, even if they seem to come from trusted sources.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for U.S. government agencies to patch a serious vulnerability in Ivanti Endpoint Manager Mobile (EPMM). This flaw has been exploited in attacks since January, making it a significant risk for federal systems. Agencies have only until Sunday to address this issue, underscoring the urgency to protect sensitive data from potential breaches. The vulnerability affects the Ivanti EPMM software, which is widely used for managing mobile devices. Failure to patch could leave these systems open to further exploitation by attackers, which could have serious implications for national security.
OpenSSL has released patches for seven vulnerabilities, with many of them potentially allowing denial-of-service (DoS) attacks. The most notable of these is a data leakage vulnerability that could expose sensitive information. This issue affects a wide range of systems that rely on OpenSSL for secure communications, making it crucial for organizations to update their software to protect against possible exploits. Users and companies should prioritize applying the latest updates to mitigate risks associated with these vulnerabilities. Ignoring these patches could leave systems vulnerable to attacks that disrupt services or compromise data security.
A critical vulnerability has been discovered in Ninja Forms, a popular WordPress plugin, with a severity rating of 9.8 out of 10. This flaw affects versions up to 3.3.26 and could allow attackers to execute remote code on affected sites. Users running this version of Ninja Forms are at significant risk, as the vulnerability could be exploited to gain unauthorized access or control over their websites. It's crucial for website administrators to address this issue promptly to prevent potential exploitation. Users should update to the latest version of the plugin to protect their sites from this serious threat.