Overview
- Apache Software Foundation
- Apache HTTP Server
Description
Statistics
- 10 Posts
- 7 Interactions
Fediverse
#Apache Patches Critical HTTP Server #RCE #Vulnerability.
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled:
👇
https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google
Anyway I can't be too smug about Microsoft; I got an email from #NCSC last night about unpatched CVE-2026-119618 in the upstream #Apache container for my self-hosted #Nextcloud and had to take it offline for a couple of hours while I figured out rebuilding dependent #PHP containers....
POV: anthropic and google both found the same apache bug before you patched it
CVE-2026-119618, a race condition in HTTP/2 headers
affected: 2.4.55 to 2.4.70
fix: 2.4.71
no public exploit yet, per wiz
can't patch today? turn off HTTP/2:
Protocols http/1.1
https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
“A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).
The Apache Software Foundation has fixed the issue, now tracked as CVE-2026-119618, but a significant number of servers are vulnerable and reachable over the public internet.”
N-central Attacks Continue, Plus 4 Tech Stories https://raymondtec.com/2026/11/n-central-attacks-continue-plus-4-tech-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief
Attackers compromised N-central servers already running Hotfix 2. Plus an Apache HTTP/2 flaw, GitHub Actions credential theft, a Windows update failure, and a LinkedIn privacy ruling.
#TechNews #ApacheHTTPServer #CVE2026119618 #FourthCircuit #GitHub #GitHubActions #LinkedIn
Bluesky
Overview
Description
Statistics
- 7 Posts
- 2 Interactions
Fediverse
🚨 Hackers exploit Check Point zero-day to gain root access, deploy backdoors, and wipe VMware servers
PoC: https://github.com/googlesky/CVE-2026-123039
Check Point has confirmed active exploitation of CVE-2026-123039, a privilege escalation vulnerability that attackers chained with PHP2Shell to gain root access to vulnerable Security Gateways.
The attacks began October 30, initially targeting Israeli organizations before expanding worldwide. Hackers deployed persistent backdoors, stole configurations, and moved laterally into VMware ESXi infrastructure, where destructive wiper malware was used.
Check Point confirmed approximately two dozen unpatched systems were compromised.
Security fixes were available before the attacks, and administrators are urged to install the latest Jumbo Hotfix immediately.
Source: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
Unknown actors targeted unpatched Check Point Security Gateways from Oct.
30, 2026.
The first wave targeted Israeli organizations; a broader wave on Nov.
2 targeted multiple countries and sectors.
Initial access used PHP2Shell vulnerabilities, followed by privilege escalation via CVE-2026-123039.
The activity involved the persistent TSGA backdoor and its TSProxy networking component, as well as a Linux wiper that recursive…
Check Point Gateway Hack: PHP2Shell, CVE-2026-123039 and the TSGA Backdoor
Check Point gateways were hit by PHP2Shell and CVE-2026-123039 root escalation, then TSGA backdoor and ESXi wipers. Get the IOCs, hotfixes and hunting stepshttps://thecybersecguru.com/news/check-point-cve-2026-123039-php2shell-tsga/
Bluesky
Overview
Description
Statistics
- 9 Posts
- 5 Interactions
Fediverse
Global Microsoft services, including Outlook and Teams, experienced outages, coinciding with active exploitation of an Outlook vulnerability (CVE-2026-124194). Critical patches are also urged for exploited GPUStack AI cluster flaws. Geopolitically, US diplomats met with Ukraine and Russia to discuss peace, achieving an agreement on a prisoner exchange but no major breakthrough on lasting peace. In tech news, NVIDIA CEO Jensen Huang resigned, with Colette Kress appointed interim CEO. Additionally, AI-assisted research identified 66 new flaws in critical infrastructure TCP/IP stacks. (Nov 12-13, 2026)
Wait... #Microsoft confirmed active exploitation of a new Outlook zero day. The CVE record was updated yesterday. And a bit later the light goes out for #Microsoft365 apps.
I'm no #infoSec expert, but it seems quite a coincidence. Faulty update maybe?
(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-124194 – Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Executive risk and governance perspective on CVE-2026-124194, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....
This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap
It’s the second Tuesday of the month, and that means another Microsoft Patch Tuesday. The new normal is that the numbers are hard to believe. Brian Krebs reports that this month’s release fixes nearly 1,100 vulnerabilities, 63 of them rated critical, and over 500 that let an attacker elevate their privileges. Only one is reported as actively exploited: CVE-2026-124194, a spoofing bug in Outlook. Microsoft has now shipped more than 5,100 security fixes this year, after more than 1,400 last month, compared to an average of around 100 a month last year. Obviously AI tools get the credit for the volume of bugs fixed, but also of course for the volume of bugs found.
Everyone else is busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities across its operating systems, including an iMessage flaw which could let a remote attacker join a group chat and read its messages, and backported the fixes to iOS 18. Chrome 157 fixes CVE-2026-125350, another Chrome zero-day, a week after a Chrome release which fixed more than 200 bugs, Firefox 160 fixes almost 100 CVEs, and Adobe fixed more than 110.
Also since last week, zlib 1.4 shipped with more than a dozen security fixes, eight more vulnerabilities were disclosed in the X.Org server and XWayland, and Microsoft’s own Azure Linux update lists more than 470 CVEs fixed across the open source packages it ships. And for a perfect encapsulation of 2026, last month’s Patch Tuesday included a remote code execution bug in Windows Paint (CVE-2026-83844), though its description admits the code runs locally. So now I guess you can pop Calc through Paint? Does this count as a win?
Despite the absolute firehose of vulnerabilities, the Krebs article notices that of the roughly 95,000 CVEs assigned this year, only around 200 made it into the CISA list of known expoited vulnerabilities (KEV). If you have to pick and choose which updates are the most critical, start there.
*sshole under attack
Last week we covered sshole, the bug where OpenSSH on musl libc without PAM accepts any long enough password for accounts that shouldn’t take a password at all. (And we had a serious moment thinking about putting “sshole” in the article title.) It now has a CVE, CVE-2026-123158, and Ars Technica reports that it’s already being exploited. GreyNoise says honeypots it runs in Southeast Asia were hit by a group it tracks as GT10, which installed Python in order to run a backdoor with Chinese-language comments that appears to have been written with AI. WatchTowr reports exploitation tied to botnets and cryptocurrency, and Previdian has seen attempts from thirteen IP addresses in nine countries. CISA added it to its KEV catalog on November 9, with a deadline of just three days for federal agencies to patch.
Kevin Beaumont points out that, in practice, the affected population looks like Alpine Linux. Debian, Ubuntu, SUSE, Red Hat, and CentOS aren’t affected, and neither is stock OpenWrt, which uses Dropbear instead of OpenSSH. The researcher who found the bug suggests checking other musl-based systems like OpenWrt with OpenSSH installed, Buildroot, and Yocto, along with “a lot of the docker images you’ve pulled.” The OpenSSH 10.6p2 release notes credit Özgün Kültekin of Wakefield with the report, and include a notable comment about the current state of things: the OpenSSH team has “seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher,” so they’ll be making more frequent releases instead of batching fixes.
“Type a really long password” as a way past authentication isn’t new, unfortunately. Back in 2014, a five-year-old found he could log into his dad’s Xbox Live account by filling the password verification screen with spaces, and Microsoft added him to its list of credited security researchers. If you run Alpine anywhere with SSH reachable from the Internet, update OpenSSH, or at minimum turn off password logins with “PasswordAuthentication no”. I suppose it’s the flip side of the password “4” for your certificate authority? (More on this below.)
GitBook breached through its own login
GitBook, the documentation platform used by a lot of open source and commercial projects, has published a post mortem on a breach on November 2. An attacker used a flaw in GitBook’s single sign-on flow to create login sessions as GitBook staff, used those sessions to pull the credentials of a misconfigured GitHub App in GitBook’s own organization, used that to get into GitBook’s internal code repositories and eventually a Cloudflare API key, and used that key to get production secrets with full infrastructure access. If you tried to access documentation or manuals for something and it failed mysteriously, you might now know why.
GitBook took the entire platform offline for about 16 hours while it rotated every secret, revoked API tokens, and rebuilt its infrastructure, which is a painful but correct call when you don’t know what an attacker can still reach. GitBook believes the attack was aimed at a single customer, but is treating all customer data as exposed. That includes API and integration tokens, session signing secrets, and, most concerning, the ability to act as the GitBook app in any GitHub or GitLab repositories customers had connected to it. GitBook says it can’t determine whether the attacker took any action in those repositories.
Each step in that chain is a familiar mistake, but strung together they go from a login bug to the source code repositories of GitBook’s customers. GitBook has already rotated the keys for its GitHub and GitLab sync, but if you use GitBook, create new API tokens and rotate any integration secrets, and if you’ve connected it to your repositories, review recent commits and pull requests made by the GitBook app.
GhostMap crashes Android until you wipe it
Bitdefender has found a way to lock an Android phone into a crash loop just by installing an app. The app requests no permissions, contains no code, and never has to be opened. A core system process reads a malformed file inside the app, crashes, restarts, reads it again, and crashes again. Rebooting doesn’t help, and neither does safe mode; the only fix is a factory reset, unless USB debugging was already enabled and you can race the crashes to delete the file over ADB.
An Android app (APK) is really a ZIP file, and ZIP files store the same information, like file sizes and compression methods, in several places without requiring that they agree. Android reads each app many times, with separate pieces of code, to check its signature, install it, load its resources, and run it. When those readers disagree about what a file contains, you get bugs; past examples include the “Master Key” bug (CVE-2013-4787), where Android checked the signature of one file and installed a different one with the same name, and Janus (CVE-2017-13156), where a single file could be both a validly signed APK and executable code at the same time. In this case, Android’s ZIP library only checks the declared uncompressed size against the real file for entries marked as uncompressed, while the code that loads app resources treats anything not marked as compressed as uncompressed. An entry with an unusual compression method and a bogus size slips between the two, Android maps memory past the end of the file, and the process crashes when it tries to read it.
Bitdefender found the bug when a banking malware sample, mangled by a packer, crashed its analysis systems, and reproduced the crash loop on a Pixel 10 running Android 17 with the August 2026 security patch; it affects Android 10 and newer. Google closed the report as not a security issue, and says it has passed it on to a feature team. A phone that can be bricked by a zero-permission app sounds like a security issue to me, and Bitdefender points out that Google rated a similar factory-reset bug as a security fix back in 2016. Be careful what you sideload.
Follow-ups: eMudhra, freezers, and MPTCP
eMudhra has published its full post-incident report, and the Indian Express has a summary of how its certificate authority ended up with private keys as small as “4”. The keys were generated correctly in a hardware security module, but eMudhra needed to move them to new facilities in the US and EU, and wrote its own Python script to wrap and unwrap them for transport. During a rehearsal in April 2025, the script read the unwrapped key back incorrectly, truncating it, and created a new key from the result. Nobody checked the key strength or compared the certified public key to the original, the bad copy had an almost identical label, and the weak certificates passed two audit cycles. eMudhra also revealed it revoked eight more RSA keys on November 7, after previously saying they were unaffected, because it can’t show they were handled properly. BleepingComputer notes that the problem could have been caught more than a year earlier: in June 2025, eMudhra noticed certificate revocation lists signed with keys that didn’t match its CA certificates.
The fallout makes a good case for taking revocation more seriously. Ubuntu 26.10 has started rolling out upki, a Rust project which brings browser-style certificate revocation checking to the rest of the operating system, starting with curl, with OpenSSL support planned for 27.04. And in a lighter take, a thread on Mastodon demonstrates “vanity” RSA keys with readable messages embedded in the public key, including “A certificate authority almost got away with the number 4”.
In more serious follow-ups, France has formally accused Iran’s Islamic Revolutionary Guard Corps of the supermarket refrigeration attacks last month. Foreign Minister Jean-Noël Barrot called it “the first large-scale cyber-attack aimed at sabotage on our national territory,” summoned the Iranian ambassador, and promised sanctions, and the Paris prosecutor has opened an investigation into the head of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at US water utilities, and two of his deputies. Iran’s foreign ministry has rejected the accusation. It’s still not known whether the attacks elsewhere in Europe that we covered last week are related. Researchers have also found multiple exploitable vulnerabilities in the control software of the freezers, beyond the risk of default passwords, but all the articles referencing them appear to be paywalled at the moment.
Finally, Ubuntu now lists fixed kernels for the Linux MPTCP remote code execution bug from last week on 22.04, 24.04, 26.04, and 26.10. Fixes for the older 16.04, 18.04, and 20.04 releases are still in progress. Red Hat has raised its rating to Critical and has been shipping fixed kernels for RHEL 8, 9, and 10 since November 1, with OpenShift updates following this week. Both Red Hat and Ubuntu now stress that the bug isn’t specific to MPTCP. MPTCP only comes into it because that’s what Anthropic’s exploit used, so turning MPTCP off isn’t a fix, and Red Hat says OpenShift nodes in their default configuration, with MPTCP disabled, are still affected.
The good news, for now, is that nobody else seems to have a working exploit. Anthropic still hasn’t released its exploit, and as of October 30 TuxCare hadn’t reproduced it, and no independent public reproduction had turned up. The closest thing public is a proof-only PoC on GitHub which wins the race and detects the kernel leaking freed memory into a SYN-ACK, but stops well short of code execution. The Stack and BleepingComputer both report no confirmed exploitation in the wild, and the bug still isn’t in CISA’s KEV catalog. The scanning Hutchins saw last week suggests someone is preparing for the day a working exploit shows up.
Making Firefox harder to fingerprint
Browser fingerprinting identifies a browser without cookies, by combining lots of individually boring details: installed fonts, screen size, graphics hardware, how the audio system rounds numbers, and so on. Back in August, we saw AliExpress using audio fingerprinting to identify visitors. Mozilla has now published research, accepted at the ACM CCS conference, measuring which details actually make Firefox users unique, using data from almost 25 million users collected through privacy-preserving relays.
The research is behind a set of fairly small changes, shipped over the past year starting with Firefox 143, which add up. Firefox hides the size and position of the taskbar or dock from screen size measurements, reports the number of CPU cores as either 4 or 8 instead of the real count, and fixes inconsistencies in image rendering, Web Audio, and math on Android that made some users stand out. According to the study’s companion site, the percentage of users who could be uniquely identified by the most effective of three commercial fingerprinting scripts dropped from 75% to 46%. Some protections are only on by default in Private Browsing and Strict tracking protection for now. The site also has a test you can run to see how unique your own browser looks.
Funding post-quantum certificates
Let’s Encrypt has received more than €1 million from Germany’s Sovereign Tech Agency to build a Merkle Tree Certificate authority, its largest single investment in post-quantum readiness so far. Post-quantum signature algorithms are much larger than the ones used today, and replacing every signature in a TLS handshake with a post-quantum one would push the handshake well past 10 kilobytes, slowing all connections and breaking others. Merkle Tree Certificates keep things small by covering a whole batch of certificates with a single signature. The funding runs through the end of 2027, covering standards work and a production launch.
Incident response is a growth industry
Vanderbilt University told everyone on campus to shut down university devices and disconnect from university WiFi on Monday while it responds to an active cybersecurity incident, and to report anything suspicious from a separate device. Vanderbilt Health, which is a separate organization, says its systems haven’t been affected. On Tuesday, a ransomware group calling itself BYOD claimed the attack, and says it stole Social Security numbers and records for more than a million students and employees. Vanderbilt hasn’t commented on the claim.
If it feels like these announcements are getting more common, Sophos agrees. In a post on incident response demand, it argues that AI is less about new kinds of attacks and more about attackers running the same playbook faster and at larger scale, while defenders can’t patch at the same speed. Sophos says two thirds of the intrusions it investigated started with compromised credentials or other identity attacks, and attackers reached Active Directory in an average of under three and a half hours. Everyone, it says, is hiring incident responders.
hackaday.com/2026/11/13/this-w…
RE: cyberplace.social/users/GossiT…
Bluesky
Overview
Description
Statistics
- 8 Posts
- 3 Interactions
Fediverse
https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/
PostgreSQL security update 18.7 fixes 52 CVEs, including CVE-2026-6460 and 31 other code execution flaws. PostgreSQL 14 reaches end of life.
#PostgreSQL #Postgres #DatabaseSecurity #CVE #PatchNow #RCE #CyberSecurity #InfoSec
PostgreSQL has released security updates addressing 52 flaws across multiple supported branches.
The release includes a fix for a long-standing type confusion vulnerability tracked as CVE-2026-6460, carrying a CVSS score of 8.8.
Affected versions include all releases prior to 18.7, 17.12, 16.16, 15.20, and 14.25, with version 14 marking the final release for that branch.
Full remediation requires updating the database s…
https://en.hacks.gr/i-postgresql-diorthonei-52-provlimata-asfaleias-perilamvanontas-keno-22-eton/
PostgreSQL Security Update: 52 CVEs and a 22-Year-Old Bug
PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 CVEs, including a 22-year-old type confusion bug. Rebuild extensions, reindex, reset backupshttps://thecybersecguru.com/news/postgresql-security-update-52-cves-cve-2026-6460/
Bluesky
Overview
Description
Statistics
- 4 Posts
Fediverse
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
SANS is seeing exploit attempts for CVE-2026-102895, a trivial authentication bypass in GPUStack, the open-source software used to manage GPU clusters for AI workloads. Spoofing the X-Gpustack-Real-IP header with a loopback address makes GPUStack treat a request as trusted and bypass authentication. The flaw affects all GPUStack versions before 2.2.0. https://isc.sans.edu/diary/rss/33514
Bluesky
Overview
Description
Statistics
- 5 Posts
- 5 Interactions
Fediverse
Fritz! Current security topics: Vulnerability in the handling of incoming IPv4 TCP connections in the Linux kernel (CVE-2026-98432): Updates in preparation
Not nice to see this in the Fritz [Wayback/Archive] Current security topics: 06/11/2026Vulnerability in the handling of incoming IPv4 TCP connections in the Linux kernel (CVE-2026-98432): Updates in preparation Tech media are currently reporting on a vulnerability in the way the Linux kernel handles incoming IPv4…
This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap
It’s the second Tuesday of the month, and that means another Microsoft Patch Tuesday. The new normal is that the numbers are hard to believe. Brian Krebs reports that this month’s release fixes nearly 1,100 vulnerabilities, 63 of them rated critical, and over 500 that let an attacker elevate their privileges. Only one is reported as actively exploited: CVE-2026-124194, a spoofing bug in Outlook. Microsoft has now shipped more than 5,100 security fixes this year, after more than 1,400 last month, compared to an average of around 100 a month last year. Obviously AI tools get the credit for the volume of bugs fixed, but also of course for the volume of bugs found.
Everyone else is busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities across its operating systems, including an iMessage flaw which could let a remote attacker join a group chat and read its messages, and backported the fixes to iOS 18. Chrome 157 fixes CVE-2026-125350, another Chrome zero-day, a week after a Chrome release which fixed more than 200 bugs, Firefox 160 fixes almost 100 CVEs, and Adobe fixed more than 110.
Also since last week, zlib 1.4 shipped with more than a dozen security fixes, eight more vulnerabilities were disclosed in the X.Org server and XWayland, and Microsoft’s own Azure Linux update lists more than 470 CVEs fixed across the open source packages it ships. And for a perfect encapsulation of 2026, last month’s Patch Tuesday included a remote code execution bug in Windows Paint (CVE-2026-83844), though its description admits the code runs locally. So now I guess you can pop Calc through Paint? Does this count as a win?
Despite the absolute firehose of vulnerabilities, the Krebs article notices that of the roughly 95,000 CVEs assigned this year, only around 200 made it into the CISA list of known expoited vulnerabilities (KEV). If you have to pick and choose which updates are the most critical, start there.
*sshole under attack
Last week we covered sshole, the bug where OpenSSH on musl libc without PAM accepts any long enough password for accounts that shouldn’t take a password at all. (And we had a serious moment thinking about putting “sshole” in the article title.) It now has a CVE, CVE-2026-123158, and Ars Technica reports that it’s already being exploited. GreyNoise says honeypots it runs in Southeast Asia were hit by a group it tracks as GT10, which installed Python in order to run a backdoor with Chinese-language comments that appears to have been written with AI. WatchTowr reports exploitation tied to botnets and cryptocurrency, and Previdian has seen attempts from thirteen IP addresses in nine countries. CISA added it to its KEV catalog on November 9, with a deadline of just three days for federal agencies to patch.
Kevin Beaumont points out that, in practice, the affected population looks like Alpine Linux. Debian, Ubuntu, SUSE, Red Hat, and CentOS aren’t affected, and neither is stock OpenWrt, which uses Dropbear instead of OpenSSH. The researcher who found the bug suggests checking other musl-based systems like OpenWrt with OpenSSH installed, Buildroot, and Yocto, along with “a lot of the docker images you’ve pulled.” The OpenSSH 10.6p2 release notes credit Özgün Kültekin of Wakefield with the report, and include a notable comment about the current state of things: the OpenSSH team has “seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher,” so they’ll be making more frequent releases instead of batching fixes.
“Type a really long password” as a way past authentication isn’t new, unfortunately. Back in 2014, a five-year-old found he could log into his dad’s Xbox Live account by filling the password verification screen with spaces, and Microsoft added him to its list of credited security researchers. If you run Alpine anywhere with SSH reachable from the Internet, update OpenSSH, or at minimum turn off password logins with “PasswordAuthentication no”. I suppose it’s the flip side of the password “4” for your certificate authority? (More on this below.)
GitBook breached through its own login
GitBook, the documentation platform used by a lot of open source and commercial projects, has published a post mortem on a breach on November 2. An attacker used a flaw in GitBook’s single sign-on flow to create login sessions as GitBook staff, used those sessions to pull the credentials of a misconfigured GitHub App in GitBook’s own organization, used that to get into GitBook’s internal code repositories and eventually a Cloudflare API key, and used that key to get production secrets with full infrastructure access. If you tried to access documentation or manuals for something and it failed mysteriously, you might now know why.
GitBook took the entire platform offline for about 16 hours while it rotated every secret, revoked API tokens, and rebuilt its infrastructure, which is a painful but correct call when you don’t know what an attacker can still reach. GitBook believes the attack was aimed at a single customer, but is treating all customer data as exposed. That includes API and integration tokens, session signing secrets, and, most concerning, the ability to act as the GitBook app in any GitHub or GitLab repositories customers had connected to it. GitBook says it can’t determine whether the attacker took any action in those repositories.
Each step in that chain is a familiar mistake, but strung together they go from a login bug to the source code repositories of GitBook’s customers. GitBook has already rotated the keys for its GitHub and GitLab sync, but if you use GitBook, create new API tokens and rotate any integration secrets, and if you’ve connected it to your repositories, review recent commits and pull requests made by the GitBook app.
GhostMap crashes Android until you wipe it
Bitdefender has found a way to lock an Android phone into a crash loop just by installing an app. The app requests no permissions, contains no code, and never has to be opened. A core system process reads a malformed file inside the app, crashes, restarts, reads it again, and crashes again. Rebooting doesn’t help, and neither does safe mode; the only fix is a factory reset, unless USB debugging was already enabled and you can race the crashes to delete the file over ADB.
An Android app (APK) is really a ZIP file, and ZIP files store the same information, like file sizes and compression methods, in several places without requiring that they agree. Android reads each app many times, with separate pieces of code, to check its signature, install it, load its resources, and run it. When those readers disagree about what a file contains, you get bugs; past examples include the “Master Key” bug (CVE-2013-4787), where Android checked the signature of one file and installed a different one with the same name, and Janus (CVE-2017-13156), where a single file could be both a validly signed APK and executable code at the same time. In this case, Android’s ZIP library only checks the declared uncompressed size against the real file for entries marked as uncompressed, while the code that loads app resources treats anything not marked as compressed as uncompressed. An entry with an unusual compression method and a bogus size slips between the two, Android maps memory past the end of the file, and the process crashes when it tries to read it.
Bitdefender found the bug when a banking malware sample, mangled by a packer, crashed its analysis systems, and reproduced the crash loop on a Pixel 10 running Android 17 with the August 2026 security patch; it affects Android 10 and newer. Google closed the report as not a security issue, and says it has passed it on to a feature team. A phone that can be bricked by a zero-permission app sounds like a security issue to me, and Bitdefender points out that Google rated a similar factory-reset bug as a security fix back in 2016. Be careful what you sideload.
Follow-ups: eMudhra, freezers, and MPTCP
eMudhra has published its full post-incident report, and the Indian Express has a summary of how its certificate authority ended up with private keys as small as “4”. The keys were generated correctly in a hardware security module, but eMudhra needed to move them to new facilities in the US and EU, and wrote its own Python script to wrap and unwrap them for transport. During a rehearsal in April 2025, the script read the unwrapped key back incorrectly, truncating it, and created a new key from the result. Nobody checked the key strength or compared the certified public key to the original, the bad copy had an almost identical label, and the weak certificates passed two audit cycles. eMudhra also revealed it revoked eight more RSA keys on November 7, after previously saying they were unaffected, because it can’t show they were handled properly. BleepingComputer notes that the problem could have been caught more than a year earlier: in June 2025, eMudhra noticed certificate revocation lists signed with keys that didn’t match its CA certificates.
The fallout makes a good case for taking revocation more seriously. Ubuntu 26.10 has started rolling out upki, a Rust project which brings browser-style certificate revocation checking to the rest of the operating system, starting with curl, with OpenSSL support planned for 27.04. And in a lighter take, a thread on Mastodon demonstrates “vanity” RSA keys with readable messages embedded in the public key, including “A certificate authority almost got away with the number 4”.
In more serious follow-ups, France has formally accused Iran’s Islamic Revolutionary Guard Corps of the supermarket refrigeration attacks last month. Foreign Minister Jean-Noël Barrot called it “the first large-scale cyber-attack aimed at sabotage on our national territory,” summoned the Iranian ambassador, and promised sanctions, and the Paris prosecutor has opened an investigation into the head of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at US water utilities, and two of his deputies. Iran’s foreign ministry has rejected the accusation. It’s still not known whether the attacks elsewhere in Europe that we covered last week are related. Researchers have also found multiple exploitable vulnerabilities in the control software of the freezers, beyond the risk of default passwords, but all the articles referencing them appear to be paywalled at the moment.
Finally, Ubuntu now lists fixed kernels for the Linux MPTCP remote code execution bug from last week on 22.04, 24.04, 26.04, and 26.10. Fixes for the older 16.04, 18.04, and 20.04 releases are still in progress. Red Hat has raised its rating to Critical and has been shipping fixed kernels for RHEL 8, 9, and 10 since November 1, with OpenShift updates following this week. Both Red Hat and Ubuntu now stress that the bug isn’t specific to MPTCP. MPTCP only comes into it because that’s what Anthropic’s exploit used, so turning MPTCP off isn’t a fix, and Red Hat says OpenShift nodes in their default configuration, with MPTCP disabled, are still affected.
The good news, for now, is that nobody else seems to have a working exploit. Anthropic still hasn’t released its exploit, and as of October 30 TuxCare hadn’t reproduced it, and no independent public reproduction had turned up. The closest thing public is a proof-only PoC on GitHub which wins the race and detects the kernel leaking freed memory into a SYN-ACK, but stops well short of code execution. The Stack and BleepingComputer both report no confirmed exploitation in the wild, and the bug still isn’t in CISA’s KEV catalog. The scanning Hutchins saw last week suggests someone is preparing for the day a working exploit shows up.
Making Firefox harder to fingerprint
Browser fingerprinting identifies a browser without cookies, by combining lots of individually boring details: installed fonts, screen size, graphics hardware, how the audio system rounds numbers, and so on. Back in August, we saw AliExpress using audio fingerprinting to identify visitors. Mozilla has now published research, accepted at the ACM CCS conference, measuring which details actually make Firefox users unique, using data from almost 25 million users collected through privacy-preserving relays.
The research is behind a set of fairly small changes, shipped over the past year starting with Firefox 143, which add up. Firefox hides the size and position of the taskbar or dock from screen size measurements, reports the number of CPU cores as either 4 or 8 instead of the real count, and fixes inconsistencies in image rendering, Web Audio, and math on Android that made some users stand out. According to the study’s companion site, the percentage of users who could be uniquely identified by the most effective of three commercial fingerprinting scripts dropped from 75% to 46%. Some protections are only on by default in Private Browsing and Strict tracking protection for now. The site also has a test you can run to see how unique your own browser looks.
Funding post-quantum certificates
Let’s Encrypt has received more than €1 million from Germany’s Sovereign Tech Agency to build a Merkle Tree Certificate authority, its largest single investment in post-quantum readiness so far. Post-quantum signature algorithms are much larger than the ones used today, and replacing every signature in a TLS handshake with a post-quantum one would push the handshake well past 10 kilobytes, slowing all connections and breaking others. Merkle Tree Certificates keep things small by covering a whole batch of certificates with a single signature. The funding runs through the end of 2027, covering standards work and a production launch.
Incident response is a growth industry
Vanderbilt University told everyone on campus to shut down university devices and disconnect from university WiFi on Monday while it responds to an active cybersecurity incident, and to report anything suspicious from a separate device. Vanderbilt Health, which is a separate organization, says its systems haven’t been affected. On Tuesday, a ransomware group calling itself BYOD claimed the attack, and says it stole Social Security numbers and records for more than a million students and employees. Vanderbilt hasn’t commented on the claim.
If it feels like these announcements are getting more common, Sophos agrees. In a post on incident response demand, it argues that AI is less about new kinds of attacks and more about attackers running the same playbook faster and at larger scale, while defenders can’t patch at the same speed. Sophos says two thirds of the intrusions it investigated started with compromised credentials or other identity attacks, and attackers reached Active Directory in an average of under three and a half hours. Everyone, it says, is hiring incident responders.
hackaday.com/2026/11/13/this-w…
RE: cyberplace.social/users/GossiT…
Bluesky
Overview
- Citrix NetScaler
- ADC
Description
Statistics
- 3 Posts
- 1 Interaction
Fediverse
CVE-2026-120868 is a CRITICAL memory overflow in Citrix NetScaler ADC/Gateway (CVSS 9.3). Exploitation leads to denial of service or erratic behavior. Patch to 14.1-73.58/13.1-64.39 now. Details: https://radar.offseq.com/threat/cve-2026-120868-memory-overflow-in-packet-processing-can-lead-to-unpredictable-or-erroneous-behavior-c23ec696d999cbc7 #OffSeq #Citrix #Vuln #PatchNow
🚨 Citrix patches 28 NetScaler security flaws, including a critical vulnerability affecting every default installation
Citrix has released urgent security updates addressing 28 vulnerabilities in NetScaler ADC and Gateway, including CVE-2026-120868 (CVSS 9.3), which affects all unpatched deployments without requiring any special configuration.
The flaw allows unauthenticated attackers to trigger memory corruption and potentially crash affected appliances. Another critical vulnerability, CVE-2026-107412 (CVSS 9.5), affects systems configured as VPN gateways or authentication servers.
Affected versions include NetScaler 13.1 and 14.1, with security fixes now available. Citrix is urging administrators to patch immediately, particularly internet-facing deployments.
Source: https://support.citrix.com/external/article/CTX697305
Description
Statistics
- 3 Posts
- 4 Interactions
Fediverse
Odd that the MSRC advisory for CVE-2026-125350 itself doesn't mention that there's an exploit in the wild: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-125350
They usually do.
This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap
It’s the second Tuesday of the month, and that means another Microsoft Patch Tuesday. The new normal is that the numbers are hard to believe. Brian Krebs reports that this month’s release fixes nearly 1,100 vulnerabilities, 63 of them rated critical, and over 500 that let an attacker elevate their privileges. Only one is reported as actively exploited: CVE-2026-124194, a spoofing bug in Outlook. Microsoft has now shipped more than 5,100 security fixes this year, after more than 1,400 last month, compared to an average of around 100 a month last year. Obviously AI tools get the credit for the volume of bugs fixed, but also of course for the volume of bugs found.
Everyone else is busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities across its operating systems, including an iMessage flaw which could let a remote attacker join a group chat and read its messages, and backported the fixes to iOS 18. Chrome 157 fixes CVE-2026-125350, another Chrome zero-day, a week after a Chrome release which fixed more than 200 bugs, Firefox 160 fixes almost 100 CVEs, and Adobe fixed more than 110.
Also since last week, zlib 1.4 shipped with more than a dozen security fixes, eight more vulnerabilities were disclosed in the X.Org server and XWayland, and Microsoft’s own Azure Linux update lists more than 470 CVEs fixed across the open source packages it ships. And for a perfect encapsulation of 2026, last month’s Patch Tuesday included a remote code execution bug in Windows Paint (CVE-2026-83844), though its description admits the code runs locally. So now I guess you can pop Calc through Paint? Does this count as a win?
Despite the absolute firehose of vulnerabilities, the Krebs article notices that of the roughly 95,000 CVEs assigned this year, only around 200 made it into the CISA list of known expoited vulnerabilities (KEV). If you have to pick and choose which updates are the most critical, start there.
*sshole under attack
Last week we covered sshole, the bug where OpenSSH on musl libc without PAM accepts any long enough password for accounts that shouldn’t take a password at all. (And we had a serious moment thinking about putting “sshole” in the article title.) It now has a CVE, CVE-2026-123158, and Ars Technica reports that it’s already being exploited. GreyNoise says honeypots it runs in Southeast Asia were hit by a group it tracks as GT10, which installed Python in order to run a backdoor with Chinese-language comments that appears to have been written with AI. WatchTowr reports exploitation tied to botnets and cryptocurrency, and Previdian has seen attempts from thirteen IP addresses in nine countries. CISA added it to its KEV catalog on November 9, with a deadline of just three days for federal agencies to patch.
Kevin Beaumont points out that, in practice, the affected population looks like Alpine Linux. Debian, Ubuntu, SUSE, Red Hat, and CentOS aren’t affected, and neither is stock OpenWrt, which uses Dropbear instead of OpenSSH. The researcher who found the bug suggests checking other musl-based systems like OpenWrt with OpenSSH installed, Buildroot, and Yocto, along with “a lot of the docker images you’ve pulled.” The OpenSSH 10.6p2 release notes credit Özgün Kültekin of Wakefield with the report, and include a notable comment about the current state of things: the OpenSSH team has “seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher,” so they’ll be making more frequent releases instead of batching fixes.
“Type a really long password” as a way past authentication isn’t new, unfortunately. Back in 2014, a five-year-old found he could log into his dad’s Xbox Live account by filling the password verification screen with spaces, and Microsoft added him to its list of credited security researchers. If you run Alpine anywhere with SSH reachable from the Internet, update OpenSSH, or at minimum turn off password logins with “PasswordAuthentication no”. I suppose it’s the flip side of the password “4” for your certificate authority? (More on this below.)
GitBook breached through its own login
GitBook, the documentation platform used by a lot of open source and commercial projects, has published a post mortem on a breach on November 2. An attacker used a flaw in GitBook’s single sign-on flow to create login sessions as GitBook staff, used those sessions to pull the credentials of a misconfigured GitHub App in GitBook’s own organization, used that to get into GitBook’s internal code repositories and eventually a Cloudflare API key, and used that key to get production secrets with full infrastructure access. If you tried to access documentation or manuals for something and it failed mysteriously, you might now know why.
GitBook took the entire platform offline for about 16 hours while it rotated every secret, revoked API tokens, and rebuilt its infrastructure, which is a painful but correct call when you don’t know what an attacker can still reach. GitBook believes the attack was aimed at a single customer, but is treating all customer data as exposed. That includes API and integration tokens, session signing secrets, and, most concerning, the ability to act as the GitBook app in any GitHub or GitLab repositories customers had connected to it. GitBook says it can’t determine whether the attacker took any action in those repositories.
Each step in that chain is a familiar mistake, but strung together they go from a login bug to the source code repositories of GitBook’s customers. GitBook has already rotated the keys for its GitHub and GitLab sync, but if you use GitBook, create new API tokens and rotate any integration secrets, and if you’ve connected it to your repositories, review recent commits and pull requests made by the GitBook app.
GhostMap crashes Android until you wipe it
Bitdefender has found a way to lock an Android phone into a crash loop just by installing an app. The app requests no permissions, contains no code, and never has to be opened. A core system process reads a malformed file inside the app, crashes, restarts, reads it again, and crashes again. Rebooting doesn’t help, and neither does safe mode; the only fix is a factory reset, unless USB debugging was already enabled and you can race the crashes to delete the file over ADB.
An Android app (APK) is really a ZIP file, and ZIP files store the same information, like file sizes and compression methods, in several places without requiring that they agree. Android reads each app many times, with separate pieces of code, to check its signature, install it, load its resources, and run it. When those readers disagree about what a file contains, you get bugs; past examples include the “Master Key” bug (CVE-2013-4787), where Android checked the signature of one file and installed a different one with the same name, and Janus (CVE-2017-13156), where a single file could be both a validly signed APK and executable code at the same time. In this case, Android’s ZIP library only checks the declared uncompressed size against the real file for entries marked as uncompressed, while the code that loads app resources treats anything not marked as compressed as uncompressed. An entry with an unusual compression method and a bogus size slips between the two, Android maps memory past the end of the file, and the process crashes when it tries to read it.
Bitdefender found the bug when a banking malware sample, mangled by a packer, crashed its analysis systems, and reproduced the crash loop on a Pixel 10 running Android 17 with the August 2026 security patch; it affects Android 10 and newer. Google closed the report as not a security issue, and says it has passed it on to a feature team. A phone that can be bricked by a zero-permission app sounds like a security issue to me, and Bitdefender points out that Google rated a similar factory-reset bug as a security fix back in 2016. Be careful what you sideload.
Follow-ups: eMudhra, freezers, and MPTCP
eMudhra has published its full post-incident report, and the Indian Express has a summary of how its certificate authority ended up with private keys as small as “4”. The keys were generated correctly in a hardware security module, but eMudhra needed to move them to new facilities in the US and EU, and wrote its own Python script to wrap and unwrap them for transport. During a rehearsal in April 2025, the script read the unwrapped key back incorrectly, truncating it, and created a new key from the result. Nobody checked the key strength or compared the certified public key to the original, the bad copy had an almost identical label, and the weak certificates passed two audit cycles. eMudhra also revealed it revoked eight more RSA keys on November 7, after previously saying they were unaffected, because it can’t show they were handled properly. BleepingComputer notes that the problem could have been caught more than a year earlier: in June 2025, eMudhra noticed certificate revocation lists signed with keys that didn’t match its CA certificates.
The fallout makes a good case for taking revocation more seriously. Ubuntu 26.10 has started rolling out upki, a Rust project which brings browser-style certificate revocation checking to the rest of the operating system, starting with curl, with OpenSSL support planned for 27.04. And in a lighter take, a thread on Mastodon demonstrates “vanity” RSA keys with readable messages embedded in the public key, including “A certificate authority almost got away with the number 4”.
In more serious follow-ups, France has formally accused Iran’s Islamic Revolutionary Guard Corps of the supermarket refrigeration attacks last month. Foreign Minister Jean-Noël Barrot called it “the first large-scale cyber-attack aimed at sabotage on our national territory,” summoned the Iranian ambassador, and promised sanctions, and the Paris prosecutor has opened an investigation into the head of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at US water utilities, and two of his deputies. Iran’s foreign ministry has rejected the accusation. It’s still not known whether the attacks elsewhere in Europe that we covered last week are related. Researchers have also found multiple exploitable vulnerabilities in the control software of the freezers, beyond the risk of default passwords, but all the articles referencing them appear to be paywalled at the moment.
Finally, Ubuntu now lists fixed kernels for the Linux MPTCP remote code execution bug from last week on 22.04, 24.04, 26.04, and 26.10. Fixes for the older 16.04, 18.04, and 20.04 releases are still in progress. Red Hat has raised its rating to Critical and has been shipping fixed kernels for RHEL 8, 9, and 10 since November 1, with OpenShift updates following this week. Both Red Hat and Ubuntu now stress that the bug isn’t specific to MPTCP. MPTCP only comes into it because that’s what Anthropic’s exploit used, so turning MPTCP off isn’t a fix, and Red Hat says OpenShift nodes in their default configuration, with MPTCP disabled, are still affected.
The good news, for now, is that nobody else seems to have a working exploit. Anthropic still hasn’t released its exploit, and as of October 30 TuxCare hadn’t reproduced it, and no independent public reproduction had turned up. The closest thing public is a proof-only PoC on GitHub which wins the race and detects the kernel leaking freed memory into a SYN-ACK, but stops well short of code execution. The Stack and BleepingComputer both report no confirmed exploitation in the wild, and the bug still isn’t in CISA’s KEV catalog. The scanning Hutchins saw last week suggests someone is preparing for the day a working exploit shows up.
Making Firefox harder to fingerprint
Browser fingerprinting identifies a browser without cookies, by combining lots of individually boring details: installed fonts, screen size, graphics hardware, how the audio system rounds numbers, and so on. Back in August, we saw AliExpress using audio fingerprinting to identify visitors. Mozilla has now published research, accepted at the ACM CCS conference, measuring which details actually make Firefox users unique, using data from almost 25 million users collected through privacy-preserving relays.
The research is behind a set of fairly small changes, shipped over the past year starting with Firefox 143, which add up. Firefox hides the size and position of the taskbar or dock from screen size measurements, reports the number of CPU cores as either 4 or 8 instead of the real count, and fixes inconsistencies in image rendering, Web Audio, and math on Android that made some users stand out. According to the study’s companion site, the percentage of users who could be uniquely identified by the most effective of three commercial fingerprinting scripts dropped from 75% to 46%. Some protections are only on by default in Private Browsing and Strict tracking protection for now. The site also has a test you can run to see how unique your own browser looks.
Funding post-quantum certificates
Let’s Encrypt has received more than €1 million from Germany’s Sovereign Tech Agency to build a Merkle Tree Certificate authority, its largest single investment in post-quantum readiness so far. Post-quantum signature algorithms are much larger than the ones used today, and replacing every signature in a TLS handshake with a post-quantum one would push the handshake well past 10 kilobytes, slowing all connections and breaking others. Merkle Tree Certificates keep things small by covering a whole batch of certificates with a single signature. The funding runs through the end of 2027, covering standards work and a production launch.
Incident response is a growth industry
Vanderbilt University told everyone on campus to shut down university devices and disconnect from university WiFi on Monday while it responds to an active cybersecurity incident, and to report anything suspicious from a separate device. Vanderbilt Health, which is a separate organization, says its systems haven’t been affected. On Tuesday, a ransomware group calling itself BYOD claimed the attack, and says it stole Social Security numbers and records for more than a million students and employees. Vanderbilt hasn’t commented on the claim.
If it feels like these announcements are getting more common, Sophos agrees. In a post on incident response demand, it argues that AI is less about new kinds of attacks and more about attackers running the same playbook faster and at larger scale, while defenders can’t patch at the same speed. Sophos says two thirds of the intrusions it investigated started with compromised credentials or other identity attacks, and attackers reached Active Directory in an average of under three and a half hours. Everyone, it says, is hiring incident responders.
hackaday.com/2026/11/13/this-w…
RE: cyberplace.social/users/GossiT…
Overview
- Citrix NetScaler
- ADC
Description
Statistics
- 3 Posts
- 3 Interactions
Fediverse
CVE-2026-107412 | CRITICAL memory overflow in Citrix NetScaler ADC/Gateway (CVSS 9.5). Affects <14.1-73.58 & <13.1-64.39. Can cause denial of service. Patch immediately to fixed versions. https://radar.offseq.com/threat/cve-2026-107412-multiple-memory-overflow-vulnerabilities-can-lead-to-unpredictable-or-erroneous-4e2ceac955d02e79 #OffSeq #Citrix #Infosec #Vuln
Citrix NetScaler ADC & Gateway face CRITICAL memory overflow vulnerabilities (CVE-2026-107412, CVSS 9.5). Risk: DoS & unpredictable behavior. No patch or version details yet — track vendor advisories. https://radar.offseq.com/threat/multiple-memory-overflow-vulnerabilities-can-lead-to-unpredictable-or-erroneous-behavior-and-denial-of-355bfe4e95285557 #OffSeq #Citrix #InfoSec #DoS
🚨 Citrix patches 28 NetScaler security flaws, including a critical vulnerability affecting every default installation
Citrix has released urgent security updates addressing 28 vulnerabilities in NetScaler ADC and Gateway, including CVE-2026-120868 (CVSS 9.3), which affects all unpatched deployments without requiring any special configuration.
The flaw allows unauthenticated attackers to trigger memory corruption and potentially crash affected appliances. Another critical vulnerability, CVE-2026-107412 (CVSS 9.5), affects systems configured as VPN gateways or authentication servers.
Affected versions include NetScaler 13.1 and 14.1, with security fixes now available. Citrix is urging administrators to patch immediately, particularly internet-facing deployments.
Source: https://support.citrix.com/external/article/CTX697305
Overview
Description
Statistics
- 2 Posts
- 2 Interactions
Fediverse
New tutorial: your first MLOX project in five minutes 🦥
Install MLOX, create an encrypted project, spin up a local Ubuntu VM with Docker and run your first app on it, all from the terminal UI.
Secure by default: when MLOX sets up a server, it turns off SSH password and keyboard-interactive logins and connects with its own key. That's the recommended mitigation for password bypasses like last week's sshole (CVE-2026-123158).
This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap
It’s the second Tuesday of the month, and that means another Microsoft Patch Tuesday. The new normal is that the numbers are hard to believe. Brian Krebs reports that this month’s release fixes nearly 1,100 vulnerabilities, 63 of them rated critical, and over 500 that let an attacker elevate their privileges. Only one is reported as actively exploited: CVE-2026-124194, a spoofing bug in Outlook. Microsoft has now shipped more than 5,100 security fixes this year, after more than 1,400 last month, compared to an average of around 100 a month last year. Obviously AI tools get the credit for the volume of bugs fixed, but also of course for the volume of bugs found.
Everyone else is busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities across its operating systems, including an iMessage flaw which could let a remote attacker join a group chat and read its messages, and backported the fixes to iOS 18. Chrome 157 fixes CVE-2026-125350, another Chrome zero-day, a week after a Chrome release which fixed more than 200 bugs, Firefox 160 fixes almost 100 CVEs, and Adobe fixed more than 110.
Also since last week, zlib 1.4 shipped with more than a dozen security fixes, eight more vulnerabilities were disclosed in the X.Org server and XWayland, and Microsoft’s own Azure Linux update lists more than 470 CVEs fixed across the open source packages it ships. And for a perfect encapsulation of 2026, last month’s Patch Tuesday included a remote code execution bug in Windows Paint (CVE-2026-83844), though its description admits the code runs locally. So now I guess you can pop Calc through Paint? Does this count as a win?
Despite the absolute firehose of vulnerabilities, the Krebs article notices that of the roughly 95,000 CVEs assigned this year, only around 200 made it into the CISA list of known expoited vulnerabilities (KEV). If you have to pick and choose which updates are the most critical, start there.
*sshole under attack
Last week we covered sshole, the bug where OpenSSH on musl libc without PAM accepts any long enough password for accounts that shouldn’t take a password at all. (And we had a serious moment thinking about putting “sshole” in the article title.) It now has a CVE, CVE-2026-123158, and Ars Technica reports that it’s already being exploited. GreyNoise says honeypots it runs in Southeast Asia were hit by a group it tracks as GT10, which installed Python in order to run a backdoor with Chinese-language comments that appears to have been written with AI. WatchTowr reports exploitation tied to botnets and cryptocurrency, and Previdian has seen attempts from thirteen IP addresses in nine countries. CISA added it to its KEV catalog on November 9, with a deadline of just three days for federal agencies to patch.
Kevin Beaumont points out that, in practice, the affected population looks like Alpine Linux. Debian, Ubuntu, SUSE, Red Hat, and CentOS aren’t affected, and neither is stock OpenWrt, which uses Dropbear instead of OpenSSH. The researcher who found the bug suggests checking other musl-based systems like OpenWrt with OpenSSH installed, Buildroot, and Yocto, along with “a lot of the docker images you’ve pulled.” The OpenSSH 10.6p2 release notes credit Özgün Kültekin of Wakefield with the report, and include a notable comment about the current state of things: the OpenSSH team has “seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher,” so they’ll be making more frequent releases instead of batching fixes.
“Type a really long password” as a way past authentication isn’t new, unfortunately. Back in 2014, a five-year-old found he could log into his dad’s Xbox Live account by filling the password verification screen with spaces, and Microsoft added him to its list of credited security researchers. If you run Alpine anywhere with SSH reachable from the Internet, update OpenSSH, or at minimum turn off password logins with “PasswordAuthentication no”. I suppose it’s the flip side of the password “4” for your certificate authority? (More on this below.)
GitBook breached through its own login
GitBook, the documentation platform used by a lot of open source and commercial projects, has published a post mortem on a breach on November 2. An attacker used a flaw in GitBook’s single sign-on flow to create login sessions as GitBook staff, used those sessions to pull the credentials of a misconfigured GitHub App in GitBook’s own organization, used that to get into GitBook’s internal code repositories and eventually a Cloudflare API key, and used that key to get production secrets with full infrastructure access. If you tried to access documentation or manuals for something and it failed mysteriously, you might now know why.
GitBook took the entire platform offline for about 16 hours while it rotated every secret, revoked API tokens, and rebuilt its infrastructure, which is a painful but correct call when you don’t know what an attacker can still reach. GitBook believes the attack was aimed at a single customer, but is treating all customer data as exposed. That includes API and integration tokens, session signing secrets, and, most concerning, the ability to act as the GitBook app in any GitHub or GitLab repositories customers had connected to it. GitBook says it can’t determine whether the attacker took any action in those repositories.
Each step in that chain is a familiar mistake, but strung together they go from a login bug to the source code repositories of GitBook’s customers. GitBook has already rotated the keys for its GitHub and GitLab sync, but if you use GitBook, create new API tokens and rotate any integration secrets, and if you’ve connected it to your repositories, review recent commits and pull requests made by the GitBook app.
GhostMap crashes Android until you wipe it
Bitdefender has found a way to lock an Android phone into a crash loop just by installing an app. The app requests no permissions, contains no code, and never has to be opened. A core system process reads a malformed file inside the app, crashes, restarts, reads it again, and crashes again. Rebooting doesn’t help, and neither does safe mode; the only fix is a factory reset, unless USB debugging was already enabled and you can race the crashes to delete the file over ADB.
An Android app (APK) is really a ZIP file, and ZIP files store the same information, like file sizes and compression methods, in several places without requiring that they agree. Android reads each app many times, with separate pieces of code, to check its signature, install it, load its resources, and run it. When those readers disagree about what a file contains, you get bugs; past examples include the “Master Key” bug (CVE-2013-4787), where Android checked the signature of one file and installed a different one with the same name, and Janus (CVE-2017-13156), where a single file could be both a validly signed APK and executable code at the same time. In this case, Android’s ZIP library only checks the declared uncompressed size against the real file for entries marked as uncompressed, while the code that loads app resources treats anything not marked as compressed as uncompressed. An entry with an unusual compression method and a bogus size slips between the two, Android maps memory past the end of the file, and the process crashes when it tries to read it.
Bitdefender found the bug when a banking malware sample, mangled by a packer, crashed its analysis systems, and reproduced the crash loop on a Pixel 10 running Android 17 with the August 2026 security patch; it affects Android 10 and newer. Google closed the report as not a security issue, and says it has passed it on to a feature team. A phone that can be bricked by a zero-permission app sounds like a security issue to me, and Bitdefender points out that Google rated a similar factory-reset bug as a security fix back in 2016. Be careful what you sideload.
Follow-ups: eMudhra, freezers, and MPTCP
eMudhra has published its full post-incident report, and the Indian Express has a summary of how its certificate authority ended up with private keys as small as “4”. The keys were generated correctly in a hardware security module, but eMudhra needed to move them to new facilities in the US and EU, and wrote its own Python script to wrap and unwrap them for transport. During a rehearsal in April 2025, the script read the unwrapped key back incorrectly, truncating it, and created a new key from the result. Nobody checked the key strength or compared the certified public key to the original, the bad copy had an almost identical label, and the weak certificates passed two audit cycles. eMudhra also revealed it revoked eight more RSA keys on November 7, after previously saying they were unaffected, because it can’t show they were handled properly. BleepingComputer notes that the problem could have been caught more than a year earlier: in June 2025, eMudhra noticed certificate revocation lists signed with keys that didn’t match its CA certificates.
The fallout makes a good case for taking revocation more seriously. Ubuntu 26.10 has started rolling out upki, a Rust project which brings browser-style certificate revocation checking to the rest of the operating system, starting with curl, with OpenSSL support planned for 27.04. And in a lighter take, a thread on Mastodon demonstrates “vanity” RSA keys with readable messages embedded in the public key, including “A certificate authority almost got away with the number 4”.
In more serious follow-ups, France has formally accused Iran’s Islamic Revolutionary Guard Corps of the supermarket refrigeration attacks last month. Foreign Minister Jean-Noël Barrot called it “the first large-scale cyber-attack aimed at sabotage on our national territory,” summoned the Iranian ambassador, and promised sanctions, and the Paris prosecutor has opened an investigation into the head of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at US water utilities, and two of his deputies. Iran’s foreign ministry has rejected the accusation. It’s still not known whether the attacks elsewhere in Europe that we covered last week are related. Researchers have also found multiple exploitable vulnerabilities in the control software of the freezers, beyond the risk of default passwords, but all the articles referencing them appear to be paywalled at the moment.
Finally, Ubuntu now lists fixed kernels for the Linux MPTCP remote code execution bug from last week on 22.04, 24.04, 26.04, and 26.10. Fixes for the older 16.04, 18.04, and 20.04 releases are still in progress. Red Hat has raised its rating to Critical and has been shipping fixed kernels for RHEL 8, 9, and 10 since November 1, with OpenShift updates following this week. Both Red Hat and Ubuntu now stress that the bug isn’t specific to MPTCP. MPTCP only comes into it because that’s what Anthropic’s exploit used, so turning MPTCP off isn’t a fix, and Red Hat says OpenShift nodes in their default configuration, with MPTCP disabled, are still affected.
The good news, for now, is that nobody else seems to have a working exploit. Anthropic still hasn’t released its exploit, and as of October 30 TuxCare hadn’t reproduced it, and no independent public reproduction had turned up. The closest thing public is a proof-only PoC on GitHub which wins the race and detects the kernel leaking freed memory into a SYN-ACK, but stops well short of code execution. The Stack and BleepingComputer both report no confirmed exploitation in the wild, and the bug still isn’t in CISA’s KEV catalog. The scanning Hutchins saw last week suggests someone is preparing for the day a working exploit shows up.
Making Firefox harder to fingerprint
Browser fingerprinting identifies a browser without cookies, by combining lots of individually boring details: installed fonts, screen size, graphics hardware, how the audio system rounds numbers, and so on. Back in August, we saw AliExpress using audio fingerprinting to identify visitors. Mozilla has now published research, accepted at the ACM CCS conference, measuring which details actually make Firefox users unique, using data from almost 25 million users collected through privacy-preserving relays.
The research is behind a set of fairly small changes, shipped over the past year starting with Firefox 143, which add up. Firefox hides the size and position of the taskbar or dock from screen size measurements, reports the number of CPU cores as either 4 or 8 instead of the real count, and fixes inconsistencies in image rendering, Web Audio, and math on Android that made some users stand out. According to the study’s companion site, the percentage of users who could be uniquely identified by the most effective of three commercial fingerprinting scripts dropped from 75% to 46%. Some protections are only on by default in Private Browsing and Strict tracking protection for now. The site also has a test you can run to see how unique your own browser looks.
Funding post-quantum certificates
Let’s Encrypt has received more than €1 million from Germany’s Sovereign Tech Agency to build a Merkle Tree Certificate authority, its largest single investment in post-quantum readiness so far. Post-quantum signature algorithms are much larger than the ones used today, and replacing every signature in a TLS handshake with a post-quantum one would push the handshake well past 10 kilobytes, slowing all connections and breaking others. Merkle Tree Certificates keep things small by covering a whole batch of certificates with a single signature. The funding runs through the end of 2027, covering standards work and a production launch.
Incident response is a growth industry
Vanderbilt University told everyone on campus to shut down university devices and disconnect from university WiFi on Monday while it responds to an active cybersecurity incident, and to report anything suspicious from a separate device. Vanderbilt Health, which is a separate organization, says its systems haven’t been affected. On Tuesday, a ransomware group calling itself BYOD claimed the attack, and says it stole Social Security numbers and records for more than a million students and employees. Vanderbilt hasn’t commented on the claim.
If it feels like these announcements are getting more common, Sophos agrees. In a post on incident response demand, it argues that AI is less about new kinds of attacks and more about attackers running the same playbook faster and at larger scale, while defenders can’t patch at the same speed. Sophos says two thirds of the intrusions it investigated started with compromised credentials or other identity attacks, and attackers reached Active Directory in an average of under three and a half hours. Everyone, it says, is hiring incident responders.
hackaday.com/2026/11/13/this-w…
RE: cyberplace.social/users/GossiT…