Human Attacker Exploits Marimo RCE to SSH in Eight Seconds

A skilled human attacker exploited the Marimo RCE vulnerability and reached an SSH bastion host in eight seconds, as The Hacker News reports based on new findings from cloud security company Sysdig. The attacker used a custom Python toolkit written and debugged by hand, with no AI agent involved, and the speed rivals what researchers typically associate with AI-assisted attacks.

The flaw is tracked as CVE-2026-39987 with a CVSS severity score of 9.3. It affects all versions of Marimo and was actively exploited within hours of public disclosure. Marimo is a Python-based notebook application; when exposed to the internet, its terminal interface can allow a remote attacker to run commands on the underlying server. The vulnerable endpoint was the /terminal/ws WebSocket, which provides a live terminal connection.

Sysdig's Threat Research Team described how the operator obtained a full interactive shell through the Marimo flaw, then made an AWS Secrets Manager call using credentials harvested from the compromised instance, and finally used a retrieved private key to authenticate to an SSH bastion host. The team noted that eight seconds is the kind of speed expected in AI-assisted attacks, but this operator got there on skill alone. The attacker also walked straight past a trap that every agentic threat actor Sysdig profiled against the same CVE had fallen into.

The session began at 12:52 p.m. with a WebSocket connection from the IP address 172.236.12[.]17. At 18:57:22 a fresh WebSocket connection was observed, at 18:57:26 a lookup against the application's stored credential returned the harvested AWS key, and at 18:57:30 SSH authentication was seen at the bastion host. The activity ended at 9:50 p.m., during which the attacker deployed an asyncssh-style listener setup against an attacker-owned virtual private server. Over the nine-hour session the operator issued more than 850 interactive commands, used no recognizable publicly available offensive tooling, and hand-rolled scripts in-session. The final tradecraft converged on a single backgrounded Python3 invocation that pulls the credential, fetches the SSH key from AWS Secrets Manager, writes it to disk, and authenticates to the bastion over SSH in one shot.

For website owners and IT teams, the Marimo case shows that development tools and notebook interfaces are high-value entry points, not just production web servers. Exposed terminal or WebSocket endpoints can give an attacker immediate command execution, and stored cloud credentials or SSH keys on that instance can quickly become a path to internal infrastructure. Sysdig's observation also challenges the assumption that only AI-assisted attackers can move at machine speed: a skilled human with custom, purpose-built scripts can be just as fast and may evade detections more effectively.

Separately, threat intelligence firm Hunt.io disclosed details of a cryptomining campaign that compromised 3,562 Redis servers, likely after a broad internet sweep of candidate Redis hosts on port 6379. The campaign launched three parallel pipelines. A WordPress target discovery pipeline scans a list of HTTPS hosts for WordPress version, installed plugins, and whether XML-RPC or directory listings are exposed. An AOF-based SSH authorized_keys injection pipeline uses Redis's append-only file mode to perform authorized_keys SSH key injection. A Lua sandbox-escape probing pipeline runs Redis EVAL commands and sandbox escape attempts against three hosts: 47.250.92[.]230, 34.166.99[.]116, and 20.198.10[.]42. The primary exploitation method uses the SLAVEOF command to smuggle attacker-controlled content onto a target Redis server, resulting in deployment of an XMRig miner. Redis is an in-memory data store often used as a database or cache; SLAVEOF makes a Redis server replicate data from another server, and XMRig is cryptocurrency mining software that attackers install secretly to use the victim's computing power. AOF is a persistence mechanism that logs every write operation so data can be replayed after a restart, and attackers can abuse it to place an SSH public key on the server and then log in.

Confirmed victims span Redis 2.8.17 from 2015 through 7.2.0 from 2023 and Linux systems from end-of-life RHEL/CentOS 6 to current Ubuntu kernels, according to Hunt.io. That wide range points to missing authentication as the weakness rather than a version-specific bug. The toolkit ran four techniques across three services, but only Redis rogue replication worked at scale: SSH key-injection and MongoDB sandbox-escape returned zero across 2,810 attempts, and a complete WordPress credential-to-webshell chain was recovered but not confirmed at scale. Hunt.io noted that the Redis campaign's WordPress scanner did recover a full credential-to-webshell chain, meaning an attacker could use stolen WordPress credentials to place a script on a website, but the researchers did not confirm it was exploited in the wild at scale.

In a related development, a single operator was linked to Operation CameraSwarm, a campaign that compromised more than 14,000 Dahua IP cameras using brute-force attacks, authentication bypass flaws tracked as CVE-2021-33044 and CVE-2021-33045, and a peer-to-peer relay technique. Brute-force means trying many username and password combinations until one works; a peer-to-peer relay lets compromised devices communicate directly without a central server. Camera hacks can turn everyday devices into parts of a botnet or surveillance risk.

For organizations running WordPress sites, the Redis campaign's scanning phase is a reminder to keep plugins and core software updated and to disable unused features like XML-RPC. AEU Hosting offers managed WordPress hosting secured end to end, which can handle those updates and access controls for site owners.

Both Sysdig and Hunt.io findings highlight that unpatched or unauthenticated internet-exposed services, from data notebooks to Redis databases to IP cameras, remain reliable entry points for attackers regardless of whether they use AI.