A critical security flaw in Marimo, a popular open-source Python notebook tool, was exploited by hackers just nine hours after being publicly disclosed, according to cloud security firm Sysdig. The vulnerability allowed attackers to gain full shell access without authentication due to a missing security check in the terminal WebSocket endpoint. The attacker built a working exploit from the security advisory alone, then used it to steal credentials and search for SSH keys in under three minutes.

The MITRE Corporation has released a new Fight Fraud Framework, or F3, designed to help organizations combat cyber fraud by documenting the tactics, techniques, and procedures fraudsters use in real-world attacks. The framework builds on MITRE's well-known ATT&CK system but introduces fraud-specific tactics like "positioning" and "monetization" to capture how attackers convert compromised assets into actual financial value. F3 is freely available and provides a common language for cyber and fraud defenders to align their detection, prevention, and response strategies.

Google has released Chrome 147 with patches for 60 security vulnerabilities, including two critical flaws in the WebML component that earned anonymous researchers $43,000 each. The critical bugs, described as a heap buffer overflow and an integer overflow, could potentially be exploited for sandbox escapes or remote code execution. The update also addresses 14 high-severity issues across various Chrome components, with no reports of active exploitation in the wild.

Nine serious vulnerabilities have been discovered in Orthanc, an open-source medical imaging server widely used in healthcare and research. The flaws, stemming from insufficient input validation and unsafe memory operations, could allow attackers to crash servers, leak sensitive data, and potentially execute arbitrary code remotely. Users running version 1.12.10 or earlier are urged to upgrade immediately to version 1.12.11, which patches all nine vulnerabilities discovered by researchers at Machine Spirits.

The US government has issued an advisory warning that Iran-linked hackers are actively targeting critical infrastructure by compromising industrial control systems, specifically Rockwell Automation programmable logic controllers, though devices from other vendors including Siemens are also at risk. The attackers are using legitimate programming software to manipulate water and energy facilities, causing operational disruptions by altering human-machine interface displays to show false data while actual system values differ dangerously. Security experts are urging organizations to immediately remove these devices from internet exposure and implement zero-trust architectures, noting that thousands of vulnerable systems remain publicly accessible despite the clear threat.

Juniper Networks has released patches for nearly three dozen vulnerabilities in its Junos OS and Junos OS Evolved products, including a critical flaw with a severity score of nine point eight. The most serious issue involves a default password in the Support Insights Virtual Lightweight Collector that could allow attackers to remotely take over vulnerable devices. The company says it's not aware of any of these vulnerabilities being exploited in the wild, and customers are urged to update their systems immediately.

In this week's cybersecurity roundup, Federal Reserve officials met with major US banks to discuss risks posed by Anthropic's powerful new Mythos AI model, which has advanced autonomous hacking capabilities that are currently restricted to select partners. Meanwhile, medical device giant Stryker confirmed a March cyberattack will significantly impact its first-quarter earnings despite restoring operations, and a frustrated researcher publicly released a Windows zero-day exploit called BlueHammer after a dispute with Microsoft over the company's handling of the vulnerability report. Other notable incidents include a hacker claiming to have stolen over 10 petabytes of data from China's National Supercomputing Center and a new Mac stealer malware specifically targeting cryptocurrency holders with over ten thousand dollars in their wallets.

Security researchers report that a critical remote code execution vulnerability in Marimo, identified as CVE-2026-39987, was actively exploited by attackers within just ten hours of its public disclosure. The rapid exploitation highlights how quickly threat actors can weaponize newly revealed security flaws, underscoring the urgent need for organizations to patch vulnerabilities immediately upon disclosure. This incident demonstrates the shrinking window defenders have to protect systems once vulnerabilities become public knowledge.

Google has launched Device Bound Session Credentials, or DBSC, in Chrome 146 for Windows, a new security feature designed to prevent session theft attacks where hackers steal authentication cookies to hijack user accounts. The technology binds login sessions directly to the user's device, making stolen session tokens useless to attackers even if they manage to extract them through malware or other means. This marks a significant step in protecting users from cookie-stealing malware, one of the most common methods cybercriminals use to bypass traditional authentication systems.

Browser extensions are emerging as a surprisingly significant channel for AI consumption that hasn't gotten much attention in the tech industry. These lightweight add-ons are becoming a primary way users interact with AI tools, seamlessly integrating AI capabilities directly into web browsing without requiring separate apps or platforms. The shift suggests that AI companies may need to rethink their distribution strategies as users increasingly prefer frictionless, browser-native experiences over standalone applications.