This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap

Microsoft's latest Patch Tuesday addressed nearly 1,100 vulnerabilities, with 63 rated critical and over 500 allowing privilege escalation. Only one vulnerability, CVE-2026-124194 affecting Outlook, is known to be actively exploited. This brings Microsoft's total security fixes for the year to over 5,100, a dramatic increase from last year's average of 100 monthly patches. The surge in vulnerabilities is attributed to both AI-assisted bug discovery and AI-assisted bug creation.

Other tech companies also released significant security updates. Apple pushed out-of-cycle fixes for at least nine vulnerabilities across its operating systems, including a critical iMessage flaw. Google Chrome addressed another zero-day vulnerability (CVE-2026-125350) just a week after fixing more than 200 bugs, while Mozilla Firefox patched nearly 100 CVEs. Adobe released fixes for over 110 vulnerabilities.

SSH Exploited in Alpine

A critical vulnerability in OpenSSH (CVE-2026-123158) affecting systems using musl libc without PAM authentication is being actively exploited. The flaw allows attackers to bypass authentication by entering sufficiently long passwords for accounts that shouldn't accept passwords. Security researcher Özgün Kültekin of Wakefield discovered the vulnerability, which has been added to CISA's Known Exploited Vulnerabilities catalog with a three-day patch deadline for federal agencies.

GreyNoise reported that honeypots in Southeast Asia were attacked by group GT10, which installed a Python backdoor with Chinese-language comments that appears AI-generated. The vulnerability primarily affects Alpine Linux, though other musl-based systems like OpenWrt with OpenSSH, Buildroot, and Yocto may also be impacted. Users are advised to update OpenSSH or disable password authentication.

GitBook Breach Exposes Data

Documentation platform GitBook suffered a breach on November 2 after an attacker exploited a flaw in its single sign-on flow. The attacker created login sessions as GitBook staff, accessed a misconfigured GitHub App, and eventually obtained a Cloudflare API key, granting full infrastructure access. GitBook took its platform offline for 16 hours to rotate secrets and rebuild infrastructure.

The breach exposed API tokens, session secrets, and the ability to act as the GitBook app in connected GitHub or GitLab repositories. While GitBook believes the attack targeted a single customer, it's treating all customer data as potentially compromised. Users should create new API tokens, rotate integration secrets, and review recent commits in connected repositories.

Android GhostMap Vulnerability

Bitdefender discovered a vulnerability that can crash Android devices into an unrecoverable loop. The exploit requires only installing a specially crafted app with no permissions that never needs to be opened. A core system process repeatedly crashes when reading a malformed file in the app, with only a factory reset resolving the issue unless USB debugging is enabled.

The vulnerability stems from inconsistencies in Android's ZIP file handling, where different components interpret file compression methods differently. Bitdefender reproduced the issue on Android 17 with the August 2026 security patch, affecting devices running Android 10 and newer. Google initially classified the issue as non-security, though Bitdefender argues it should be treated as a security flaw given its impact.