Adobe patches zero-day, Marimo flaw exploited, Venice flood threat

Summary

Episode Summary: Cybersecurity Headlines

Host: Steve Prentiss
Date: April 13, 2026
Main Theme:
A concise roundup of critical cybersecurity events and trends, spanning high-profile vulnerabilities, infrastructure threats, and international cybercrime enforcement.

---

Key Stories & Discussion Points

1. Adobe Patches Months-Old Acrobat & Reader Zero-Day

• Overview:
  Adobe released emergency patches on Saturday (April 11) for a critical, actively exploited Acrobat and Reader zero-day, which had remained unaddressed for several months.
• Details:
  • Vulnerability: Improperly controlled modifications to prototype attributes, enabling arbitrary code execution.
  • CVE: Not specified in episode, but noted as severe with a CVSS score of 9.6.
  • Affected Platforms: Windows and macOS.
  • Status: Exploited in the wild prior to patch.
• Host Quote:

  “Adobe confirms that it has been exploited in the wild.” (00:35)

---

2. Critical Marimo Flaw Under Rapid Attack

• Overview:
  Hackers began exploiting a newly disclosed flaw in Marimo, an open-source reactive Python notebook platform, within 10 hours of public disclosure.
• Details:
  • Vulnerability: Enables remote code execution without authentication.
  • CVSS Score: 9.3 / 10.
  • Primary Users: Data scientists, developers, researchers.
  • Platform: Marimo (Python notebook environment).
• Host Quote:

  “The flaw allows remote code execution without authentication... Hackers have started to exploit a critical vulnerability... just 10 hours after its public disclosure.” (01:10)

---

3. Venice Anti-Flood Infrastructure Breached

• Overview:
  Attackers gained control over Venice’s anti-flood pump system, exposing critical infrastructure vulnerabilities and offering root access for sale.
• Details:
  • Attack Timeline: Began in late March; public evidence included screenshots and system details.
  • Hacker Groups: “Infrastructure Destruction Squad”, “Dark Engine.”
  • Motive: Expose vulnerabilities; highlighted low barrier for misuse by offering access for $600.
  • Notable Statement:

    “No system updates can expel us. We have been here for months and will remain here for to come.” (01:50)

• Host Quote:

  “Their goal was to expose critical infrastructure weaknesses and offered to sell full root access... to highlight the severity of the breach...” (01:40)

---

4. Juniper Networks Patches Dozens of Vulnerabilities

• Overview:
  Juniper Networks rolled out fixes for almost three dozen vulnerabilities, several with serious implications.
• Details:
  • Most Critical:
    • CVSS Score: 9.8
    • Issue: Default password in the Support Insights Virtual Lightweight Collector; password change not enforced during setup.
  • Risks: Privilege escalation, denial of service, command execution.
• Host Quote:

  “A change of this password is not enforced... which can make full access to the system by unauthorized actors possible.” (02:30)

---

5. Supply Chain Compromises via Open Source Tools

• Overview:
  Feature coverage by The Register explores increasing attacks on supply chains through tainted open source packages.
• Recent Incidents:
  • North Korea-linked Axios attack & Trivy (Team PCP) incidents.
  • Both involved malware-laden packages used for credential theft.
• Expert Opinions:
  • Charles Carmichael, Mandiant CTO:

    “The data that was taken a few weeks ago will likely be leveraged this week, next week, next month, probably for several months, and the blast radius will continue to expand.” (03:45)

  • Nick Biasini, Cisco/Thales:

    “Attackers are starting to really look at the supply chain and open source packages and figure out ways to compromise developers to deliver malware or gather data, depending on the type of threat.” (04:05)

• Additional Concern:
  Growth of AI-powered, hyper-personalized social engineering campaigns.

---

6. International Crackdown on Crypto Fraud

• Overview:
  Multinational law enforcement action, Operation Atlantic, disrupted major cryptocurrency fraud across several countries.
• Details:
  • Led By: UK’s National Crime Agency
  • Scope: Over 20,000 victims identified in Canada, UK, and US.
  • Seized: $12 million in suspected criminal proceeds.
  • Scam Method: Approval phishing—scammers trick users into handing over wallet access via investment scams.
• Host Quote:

  “The focus of the campaign was approval phishing attacks in which scammers trick victims into granting them access to their cryptocurrency wallets, typically via investment scams.” (04:45)

---

7. Russian Submarine Activity Near UK Undersea Cables

• Overview:
  The UK detected covert Russian submarine operations near critical undersea network cables.
• Details:
  • Investigated By: UK's Main Directorate of Deep Sea Research.
  • Response: UK Defence Secretary John Healy stated three Russian submarines were tracked and sonobuoys deployed as a warning.
• Notable Quote:

  “[Sonobuoys were dropped] to inform the submarine units that they were being monitored and that their mission was no longer as covert as had been planned.” (05:35)

---

Memorable Quotes

• On persistent infrastructure attacks:

  “We have been here for months and will remain here for to come.” – Attackers’ message, as reported by Steve Prentiss (01:55)

• On expanding supply chain breaches:

  “The blast radius will continue to expand.” – Charles Carmichael, Mandiant Consulting CTO (03:45)

• On evolving attacker strategies:

  “Attackers are starting to really look at the supply chain and open source packages...” – Nick Biasini, Cisco Thales outreach lead (04:05)

---

Timestamps for Key Segments

• Adobe Acrobat/Reader Zero-Day: 00:05 – 00:50
• Marimo Vulnerability Exploitation: 00:50 – 01:20
• Venice Anti-Flood System Breach: 01:20 – 02:10
• Juniper Networks Vulnerabilities: 02:10 – 02:50
• Open Source Supply Chain Attacks: 03:20 – 04:25
• Operation Atlantic—Crypto Fraud: 04:25 – 05:10
• Russian Submarine Activity: 05:10 – 05:55

---

Takeaways

• Speed of Attack: Critical vulnerabilities are now exploited within hours of disclosure.
• Infrastructure at Risk: Even essential city infrastructure may lack adequate cyberdefenses, as seen in Venice.
• Default Credentials: Persist as an Achilles’ heel in enterprise security (ex: Juniper).
• Open Source Package Threats: Are intensifying, with both state and criminal actors targeting the supply chain.
• Social Engineering Evolution: AI is making attacks more targeted and believable.
• Crypto Scams: Remain rampant, but international cooperation can bear fruit.
• State-Backed Espionage: Undersea infrastructure becomes a new front in cybersecurity conflict.

---

For more in-depth coverage on any story, visit CISOseries.com.

Transcript

[A]

From the CISO series, it's Cybersecurity Headlines

[B]

these are the cybersecurity headlines for Monday, April 13, 2026. I'm Steve Prentiss. Adobe patches months old, reader zero day following up on a story we covered on Friday, Adobe on Saturday released emergency patches for a critical Acrobat and Reader Zero Day that has been exploited in the wild for several months. This CVE numbered vulnerability has a CVSS score of 9.6 and stems from improperly controlled modifications to prototype attributes and can be exploited to execute arbitrary code. It impacts Acrobat and Reader for Windows and macOS. Adobe confirms that it has been exploited in the wild. Critical Marimo flaw now under active exploitation Researchers at sysdig are warning that hackers have started to exploit a critical vulnerability in the Marimo open source reactive python notebook platform. That is Marimo. This just 10 hours after its public disclosure. Marimo is an open source Python notebook environment typically used by data scientists, researchers and developers building data apps or dashboards. The flaw allows remote code execution without authentication. It has a CVE number and GitHub has given it a critical score of 9.3 out of 10. Hackers claim control over Venice Anti Flood Pumps A breach which reportedly began in late March, saw attackers accessing the control interface of the pumping system and soon afterwards began releasing evidence in the form of screenshots of control panels, system layouts and valve states. The hackers, using names like Infrastructure Destruction Squad and Dark Engine, said in a Chinese language Telegram post that their goal was to expose critical infrastructure weaknesses and offered to sell full root access to the system for just $600 to highlight the severity of the breach and the low barrier to potential misuse. They additionally warned that no system updates can expel us. We have been here for months and will remain here for to come. Juniper Networks patches dozens of vulnerabilities Last week, the company released patches for nearly three dozen vulnerabilities, many of which could lead to privilege escalation, denial of service and command execution. The most severe has a CVSS score of 9.8 and it is a default password in the Support Insights Virtual Lightweight Collector. The company explained that this Virtual lightweight collector software ships with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible. Huge thanks to our sponsor Conveyor still manually filling out security questionnaires even though you have a trust center, a starter trust center is table stake and the best security teams have moved way past that. Conveyor gives you an agentic trust center, AI questionnaire, automation and a self serve layer so sales can move details forward without pinging you every five minutes. Companies like Atlassian and Zapier made the switch. C [e-mail] that is c o n v e y o r.com convey open source tool Attacks reveal the future of supply chain compromise A feature article in the Register this week looks at the future of supply chain attacks. This follows two recent attacks, both of which we reported on, one from North Korea Linked Axios and the other from Trivi T R I V Y which is associated with Team pcp. The attacks infected open source tools with malware and used this access to steal secrets from tens of thousands of organizations. Mandiant Consulting CTO Charles Carmichael, speaking to the Register, said the data that was taken a few weeks ago will likely be leveraged this week, next week, next month, probably for several months, and the blast radius will continue to expand. Cisco Thales outreach lead Nick Biasini also told the Register, attackers are starting to really look at the supply chain and open source packages and figure out ways to compromise developers to deliver malware or gather data, depending on the type of threat. This is in conjunction of course, with increased use of AI to make social engineering campaigns more believable and hyper personalized over 20,000 crypto fraud victims identified in International crackdown A joint international law enforcement action led by the UK's National Crime Agency has identified over 20,000 victims of cryptocurrency fraud across Canada, the United Kingdom and the us. This activity, named Operation Atlantic, occurred in March of this year and is said to have disrupted numerous fraud networks across the world. More than $12 million in suspected criminal proceeds was frozen and the focus of the campaign was approval phishing attacks in which scammers trick victims into granting them access to their cryptocurrency wallets, typically via investment scams. Russian Submarine activity detected near UK undersea cables the British government announced on Thursday that it had exposed a covert Russia submarine operation around cables in waters north of the United Kingdom. The activity was discovered by the UK's Main Directorate of Deep Sea Research, which operates specialized deep sea units that to survey underwater infrastructure. UK Defence Secretary John Healy said British and allied forces tracked three Russian submarines over several weeks and dropped sonobuoys to inform the submarine units that they were being monitored and that their mission was no longer as covert as had been planned, end quote. If you have some thoughts on the news from today or about this show in general, please be sure to Reach out to us at [e-mail] we would love to hear from you. I'm Steve Prentiss reporting for the CISO series.

[A]

Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines.