BloomTrading attributed the October 26, 2026 security breach to a remote code execution vulnerability in a third-party software module.