CVE-2026-39987: Marimo RCE exploited in hours after disclosure
2026-04-11T14:51:48Z•01dad2651c1e077dee5d75393545866eb9ec98188d630c58ffbb1345609ead79
Adobe Reader zero-dayAndroidBitcoin DepotCVE-2026-39987ChipSoftEngageLab SDKEurailICSIoTLucidRookMarimoMasjesuUAT-10362botnetcryptocurrency theftdata breachnational-securityphishingransomwareremote code executionvulnerabilityzero-day
What happened
Multiple high-impact incidents and vulnerabilities were reported: a critical Marimo RCE (CVE-2026-39987, CVSS 9.3) was exploited within hours of disclosure; a ransomware attack on Dutch EHR vendor ChipSoft disrupted hospital services; LucidRook (Lua-based) phishing campaigns tied to UAT-10362 targeted Taiwanese NGOs and universities; an EngageLab/EngageSDK flaw allowed Android apps to bypass sandbox protections and expose data on up to ~50M devices (including ~30M crypto wallets); Bitcoin Depot suffered credential theft and a ~50 BTC (~$3.6M) loss; Eurail notified 308,777 people after a breach
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 01dad2651c1e077dee5d75393545866eb9ec98188d630c58ffbb1345609ead79
- Enrichment time
- 2026-04-11T14:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.