cve-2026-39987

9 Hours 41 Minutes: The Patch Window Is Gone

John Z Black Apr 11, 2026

Vulnerabilities & Patching #cve-2026-39987 #marimo #rce #ai-tooling #patch-management #exploitation-timeline #sysdig

CVE-2026-39987 in Marimo was exploited less than 10 hours after the advisory dropped. No public PoC. The attacker built their own exploit from the description and went to work while most people were still reading their alerts.