This is the BlueTeamSec briefing for Monday the 2nd of November 2026. A busy one — ten stories across threat intelligence, defence, and exploitation, so let's get straight in.
The FBI have attributed the Binance cryptocurrency theft from the 29th of October to North Korea's TraderTraitor group — $6 billion taken, now being laundered through Ethereum and decentralised finance protocols. The Bureau's asking virtual asset providers to block known TraderTraitor addresses and watch for derivative wallets. Chainalysis and Microsoft have both written this one up in the past few days, so there's a fair bit of technical analysis already out there.
The University of Luxembourg have released InferD, a honeypot framework designed for AI inference infrastructure. It uses honeytokens in what they're calling a provenance plane to spot unauthorised access and adversarial behaviour targeting deployed models. The paper includes implications for hardening Model Context Protocol implementations — one to flag if you're deploying AI at scale. This follows their write-up on context bombs just last week.
CISA have launched the Installed Base Program, a voluntary partnership with original equipment manufacturers to identify and notify owners of internet-exposed legacy operational technology devices in critical infrastructure. They're using open-source scanning, administrative subpoenas via ISPs, and direct collaboration with vendors to shrink the attack surface before vulnerabilities get exploited. Particularly relevant if you're running industrial control systems.
Linux kernel developer Josef Bacik used a language model to generate fixes for memory management and filesystem bugs in October, submitting patches with transparent attribution. The fixes went through the standard kernel review process and were accepted by maintainers — they address issues in huge memory, userfaultfd, memory hotplug, multi-gen LRU, tmpfs, and process maps subsystems. Interesting case of openly disclosed AI assistance in critical infrastructure code.
Supermicro disclosed multiple vulnerabilities in its baseboard management controller firmware, ranging from low to critical severity. The issues include unprotected IPMI commands allowing arbitrary command execution, hardcoded authentication keys, and privilege escalation flaws. All Supermicro motherboard SKUs using affected firmware versions are in scope — no exploitation in the wild as of late October, but one for anyone running server hardware at scale.
A researcher published a proof of concept for CVE-2026-111497, a critical unauthenticated remote code execution flaw in WordPress environments using specific versions of PHP 8.3.36, libbrotli, and Debian. The exploit leverages malformed Brotli-encoded responses to corrupt memory pointers and achieve arbitrary command execution via XML-RPC. The PoC demonstrates data exfiltration through memory corruption techniques — worth reviewing if you're running WordPress in containerised environments.
The Drupal Security Team report that a highly critical access bypass vulnerability in the Commerce Core module is being actively exploited. The flaw allows unauthorised access to specific routes and entity fields, letting attackers manipulate order processes and access sensitive commercial data on e-commerce platforms. Affected versions include Commerce Core prior to 2.41 and versions 3.0.0 to 3.3.12 — patch immediately if you're running Drupal commerce sites. We've seen similar PHP-based exploits cropping up fairly regularly since mid-October.
Broadcom have written up a malicious service active since early 2026 that's been compromising developer environments by intercepting traffic to legitimate AI command-line tools — OpenAI's Codex and Anthropic's Claude Code CLI among them. The attack uses social engineering to get users to run a setup script that establishes an unauthorised relay, allowing interception of developer interactions with AI coding assistants. Flag this one if you're using AI-assisted development tooling in production environments.
An open-source tool called Arad-Code has been released — it's a language-model-powered static application security testing agent that uses structured playbooks to autonomously audit code for vulnerabilities. It employs evidence-driven detection with multi-layered verification gates and adversarial validation to reduce false positives, targeting complex logic bugs beyond traditional pattern matching. Worth a look if you're evaluating AI-powered security tooling for web frameworks or infrastructure-as-code.
And finally, researchers at USENIX Security 2026 developed an adversarial language-model-based framework that automatically infers precise network protocol specifications by having models generate both protocol formats and parsers that validate each other. The technique discovered 24 zero-day vulnerabilities in production-grade protocol implementations by identifying semantic constraints that traditional automated tools miss — particularly effective at finding edge-case parsing bugs that can lead to crashes, memory corruption, or remote code execution. Useful background if you're working on protocol security or fuzzing research.
That's everything for Monday the 2nd. Attribution goes to the original authors — the analysis here was automated as always.