This is the security briefing for Tuesday the 3rd of November 2026, drawn from the BlueTeamSec community on infosec.pub. A busy one today, with nine stories to get through.
InfraHunter reported on an exposed staging server belonging to the DoNot advanced threat group, containing a complete espionage toolkit targeting Pakistan's nuclear facilities and energy infrastructure. The kit included credential harvesting tools, custom reverse shells, and reconnaissance capabilities specifically designed for industrial control systems — which is either impressive tradecraft or a sign that someone left a door open, depending on your perspective.
DomainTools covered MrHex, an Iran-aligned actor that's evolved from data broker to hack-and-leak operation, now collaborating with Handala. The group is targeting U.S. and Israeli government, military, and critical infrastructure, with credible evidence they've accessed industrial human-machine interfaces — suggesting the potential for physical disruption beyond just data theft.
Chainalysis disclosed a security incident from the 30th of October in which an external threat actor used offensive agentic techniques — essentially autonomous AI agents — to gain unauthorised access to internal systems. Non-sensitive customer data including names, emails, and organisation roles were accessed, though there's no evidence of compromise to investigation content, passwords, or session tokens.
Three articles covered CVE-2026-98432, a critical use-after-free flaw in the Linux kernel's TCP stack. Researchers have demonstrated a two-stage remote exploit against servers with multipath TCP listeners that achieves kernel address randomisation bypass and root-level code execution — the issue stems from improper memory management during handshake processing. Akamai confirmed they've deployed network-level mitigations and are patching infrastructure, with no evidence of exploitation on their platform, whilst independent analysis suggests the race window is narrow and current tooling doesn't enable reliable exploitation. One to patch, but possibly not one to lose sleep over just yet.
Researchers demonstrated a novel fingerprinting technique that can uniquely identify individual graphics processors based on microscopic manufacturing variations in atomic operation timing, achieving over ninety-nine percent accuracy. The fingerprint persists across reboots and container restarts, and can be passively leaked through common machine learning framework operations — particularly relevant if you're running shared GPU infrastructure or multi-tenant cloud environments.
Cisco published analysis of VOLTA, a Windows infostealer that integrates large language models to automatically analyse and prioritise stolen victim data based on financial value. The malware uses AI models to assess monetization potential of harvested credentials, session cookies, and cryptocurrency wallets — effectively moving victim triage from manual human analysis to AI-driven processes, which represents a notable evolution in cybercrime automation.
And finally, WAF Dojo — an open-source, gamified training platform designed to teach security practitioners how to configure and optimise AWS Web Application Firewall through hands-on practice. This one's a training resource rather than a security incident, but worth flagging if you're looking to upskill your team on cloud defence.
That's everything for today from BlueTeamSec. The articles are the work of their original authors — the analysis here was automated as ever.