This is your BlueTeamSec briefing for Sunday the 25th of October 2026, with seven stories from the community on infosec.pub.
ANSSI warn that French renewable energy and water sectors have been under sustained attack since early 2025 from hacktivist groups and state-sponsored actors linked to Russia and Iran. They've been exploiting poor industrial control system hygiene — exposed management interfaces, default credentials, unauthenticated protocols — to cause operational disruption, including the temporary shutdown of a wind farm. One for critical infrastructure defenders, particularly if you're in energy or utilities.
A researcher has documented a technique to bypass enforced SMB signing by exploiting session re-authentication flaws. This undermines a key control that's meant to prevent relay attacks and man-in-the-middle activity in Windows environments. Patches are available, so worth flagging if you've been relying on enforced signing as part of your lateral movement defences.
Researchers have shown that autonomous AI cybersecurity agents can be dynamically optimised during attacks by manipulating their internal states through inference-time residual stream interventions. They achieved a four point two percentage point performance gain on the Cybench benchmark without retraining, demonstrating that AI attack agents can be steered to exhibit more efficient and unpredictable patterns while keeping safety guardrails in place. It's an interesting piece of work on how we might see adversarial AI evolve.
A red team tool called Signet has been released — it's a code-signing wrapper for the Mythic command-and-control framework that automates Authenticode signing of malicious binaries. It supports self-signed certificate generation, certificate cloning from legitimate URLs, and importing existing certificates, which means it's now even easier for operators to create signed payloads that look legitimate. Another reminder that code signing alone isn't much of a trust anchor anymore.
Trail of Bits released brotli-checker, a static analysis tool to find vulnerable copies of the Brotli data compression decoder affected by a recent CVE. It's designed to help developers and security teams scan codebases for outdated Brotli libraries that may be statically linked or bundled as dependencies in applications, containers, or embedded systems. Useful if you're running software supply chain audits or dependency inventory.
The Ruby core team released critical patches addressing multiple memory corruption vulnerabilities in the regular expression engine that could lead to remote code execution. The flaws affect Ruby applications that compile regular expressions using untrusted input and were discovered during GitLab security audits. Patches are available in Ruby versions four point zero point nine, three point four point twelve, and three point three point thirteen. We covered the GitLab critical patch release earlier this week, so this is the upstream fix.
And finally, researchers observed a campaign between October twenty-second and twenty-fourth exploiting PHP-based web applications — WordPress, Drupal, Joomla, Roundcube — using massive HTTP requests to cause memory exhaustion and service crashes. Attackers deployed payloads over thirty-three megabytes in size matching public proof-of-concept code, resulting in thirty out-of-memory errors and eleven PHP worker crashes, though no successful remote code execution or data breaches were confirmed. We've been tracking this one since the patch uptake tracker and the CISA catalogue entry came out earlier in the week.
That's your briefing for today. Attribution sits with the original authors — the analysis here was automated. Stay safe.