Security news from the BlueTeamSec community for Sunday the 8th of November 2026 — a busy one, with fifteen stories. I'm Sebastian.
And I'm Tess. Brandon Levene has put together a reproduction guide for CVE-2026-98432, a use-after-free in the Linux kernel's TCP stack that's been lurking since 2016. It affects any system running plain TCP listeners and can trigger denial of service or memory disclosure during the handshake. This follows a couple of patch advisories we covered earlier in the week — worth reading if you want the technical detail behind the headlines.
Over at sshhole.com, Özgün Kültekin has disclosed an authentication bypass in openssh-server on systems using musl libc — Alpine, OpenWrt, and similar distributions. Attackers can gain unauthorised access using passwords between 257 and 1024 characters against accounts with asterisk password fields, and Alpine's AWS and Azure images are particularly exposed because they ship with passwordless privilege escalation enabled. CISA added this to the Known Exploited Vulnerabilities catalogue last week.
Bitdefender disclosed GhostMap, a denial-of-service flaw in Android 10 and later that exploits inconsistent parsing of ZIP files to crash devices into persistent loops before you even open the malicious app. No patch is available yet, which is concerning given how trivially it can render a phone unusable.
Sekoia published findings on an APT29 watering hole campaign from October that targeted mobile devices visiting Ukrainian government and US industry sites. The operation used injection techniques, reverse proxy methods, and a supply-chain compromise of the Plerdy SEO tracker to profile visitors and exfiltrate data. This follows the Ivanti zero-day operation we covered last week — APT29's been keeping busy.
ESET have written up SlippyNunchucks, a Chinese state-aligned actor exploiting the Sogou Input Method's unencrypted brand promotion feature via DNS hijacking to distribute DarkVigil malware. The campaign's been active since 2023, targeting Chinese speakers across Asia — students, internet cafés, online gambling platforms — using DLL side-loading with legitimate Adobe binaries. Notable for the method as much as the target set.
Researchers from Elsevier published Trident, an APT attribution framework designed to handle catastrophic forgetting and data volatility by jointly modelling infrastructure relationships and behavioural tactics over heterogeneous knowledge graphs. It converts unstructured threat reports into structured subgraphs for more reliable threat actor identification — useful background if you're working on attribution or intel pipelines.
Researchers have developed HeteroScan, a malware analysis pipeline that turns dynamic sandbox traces into heterogeneous graphs to characterise post-infection behaviour. It achieved ninety-four per cent accuracy across thirty-seven families and maps detected actions to MITRE ATT&CK techniques. Covers everything from AsyncRAT to Mirai, so one for analysts looking to improve behavioural classification.
MEvince is a new framework for automating the mapping of threat reports to MITRE ATT&CK using knowledge-constrained reasoning. It addresses representation mismatch, reduces hallucinated predictions, and links technique assignments back to the specific textual evidence in the source report. Particularly relevant if you're doing detection engineering or CTI classification at scale.
An academic review from Acta Electronica Sinica covers methodologies for network traffic classification and generation, focusing on algorithms for identifying traffic types and creating synthetic datasets. Useful if you're working on detection systems or need to train models without relying on sensitive real-world data.
Cisco have published analysis of the VOLTA infostealer, which uses generative AI via third-party APIs to perform real-time victim prioritisation and intelligent data enrichment from stolen credentials. It's treating stolen data as actionable intelligence rather than bulk dumps, which raises defensive questions around session token security and detection of headless browser launches. This follows the Amatera infostealer piece from a week ago — the same trend applied differently.
Two papers on deception-based defences against autonomous agents. First, Gingerbread House, which uses source code-generated honeypots to detect and redirect autonomous penetration testing agents into isolated shadow environments — successfully diverted attacks from Claude Opus and ARTEX in testing. And AgentSnare from Cornell, which deploys a lightweight model and virtual kernel to dynamically generate fake environments that delay, divert, and defuse AI-powered attackers. Both introduce frameworks for measuring deception effectiveness, which is novel.
An open-source red team orchestration platform called ARES has been released, designed for operator-directed offensive testing and continuous security validation. It's aimed at enterprise red teams and SOCs who want to execute actual offensive modules in controlled environments to confirm exploitability rather than relying on theoretical vulnerability reports.
CISA, the FBI, and federal partners issued a joint advisory warning that attackers are actively targeting industrial refrigeration and cold chain monitoring systems in healthcare, chemical, food and agriculture, and transportation sectors. Exploitation methods include authentication bypass, code injection, and weak configurations to remotely manipulate temperature controllers, causing inventory spoilage and equipment damage. The advisory provides hardening recommendations — this follows a French CERT alert and a Censys exposure report from October.
And ENISA, the European Commission, and Europol issued a joint statement on cyber incidents affecting commercial refrigeration systems across multiple EU member states. The first wave began on the 11th of October, with a second wave on the 1st and 2nd of November. Organisations are being directed to reporting obligations under the Cyber Resilience Act and NIS2 Directive, with technical mitigation guidance maintained in ENISA's GitHub repository.
That's everything for today from BlueTeamSec. The writing is by the original authors — the analysis was automated. We'll be back next time.