It’s the second Tuesday of the month, and that means another Microsoft Patch Tuesday. The new normal is that the numbers are hard to believe. Brian Krebs reports that this month’s release fixes nearly 1,100 vulnerabilities, 63 of them rated critical, and over 500 that let an attacker elevate their privileges. Only one is reported as actively exploited: CVE-2026-124194, a spoofing bug in Outlook. Microsoft has now shipped more than 5,100 security fixes this year, after more than 1,400 last month, compared to an average of around 100 a month last year. Obviously AI tools get the credit for the volume of bugs fixed, but also of course for the volume of bugs found.

Everyone else is busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities across its operating systems, including an iMessage flaw which could let a remote attacker join a group chat and read its messages, and backported the fixes to iOS 18. Chrome 157 fixes CVE-2026-125350, another Chrome zero-day, a week after a Chrome release which fixed more than 200 bugs, Firefox 160 fixes almost 100 CVEs, and Adobe fixed more than 110.

Also since last week, zlib 1.4 shipped with more than a dozen security fixes, eight more vulnerabilities were disclosed in the X.Org server and XWayland, and Microsoft’s own Azure Linux update lists more than 470 CVEs fixed across the open source packages it ships. And for a perfect encapsulation of 2026, last month’s Patch Tuesday included a remote code execution bug in Windows Paint (CVE-2026-83844), though its description admits the code runs locally. So now I guess you can pop Calc through Paint? Does this count as a win?

Despite the absolute firehose of vulnerabilities, the Krebs article notices that of the roughly 95,000 CVEs assigned this year, only around 200 made it into the CISA list of known expoited vulnerabilities (KEV). If you have to pick and choose which updates are the most critical, start there.

*sshole under attack

Last week we covered sshole, the bug where OpenSSH on musl libc without PAM accepts any long enough password for accounts that shouldn’t take a password at all. (And we had a serious moment thinking about putting “sshole” in the article title.) It now has a CVE, CVE-2026-123158, and Ars Technica reports that it’s already being exploited. GreyNoise says honeypots it runs in Southeast Asia were hit by a group it tracks as GT10, which installed Python in order to run a backdoor with Chinese-language comments that appears to have been written with AI. WatchTowr reports exploitation tied to botnets and cryptocurrency, and Previdian has seen attempts from thirteen IP addresses in nine countries. CISA added it to its KEV catalog on November 9, with a deadline of just three days for federal agencies to patch.

Kevin Beaumont points out that, in practice, the affected population looks like Alpine Linux. Debian, Ubuntu, SUSE, Red Hat, and CentOS aren’t affected, and neither is stock OpenWrt, which uses Dropbear instead of OpenSSH. The researcher who found the bug suggests checking other musl-based systems like OpenWrt with OpenSSH installed, Buildroot, and Yocto, along with “a lot of the docker images you’ve pulled.” The OpenSSH 10.6p2 release notes credit Özgün Kültekin of Wakefield with the report, and include a notable comment about the current state of things: the OpenSSH team has “seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher,” so they’ll be making more frequent releases instead of batching fixes.

“Type a really long password” as a way past authentication isn’t new, unfortunately. Back in 2014, a five-year-old found he could log into his dad’s Xbox Live account by filling the password verification screen with spaces, and Microsoft added him to its list of credited security researchers. If you run Alpine anywhere with SSH reachable from the Internet, update OpenSSH, or at minimum turn off password logins with “PasswordAuthentication no”. I suppose it’s the flip side of the password “4” for your certificate authority? (More on this below.)

GitBook breached through its own login

GitBook, the documentation platform used by a lot of open source and commercial projects, has published a post mortem on a breach on November 2. An attacker used a flaw in GitBook’s single sign-on flow to create login sessions as GitBook staff, used those sessions to pull the credentials of a misconfigured GitHub App in GitBook’s own organization, used that to get into GitBook’s internal code repositories and eventually a Cloudflare API key, and used that key to get production secrets with full infrastructure access. If you tried to access documentation or manuals for something and it failed mysteriously, you might now know why.

GitBook took the entire platform offline for about 16 hours while it rotated every secret, revoked API tokens, and rebuilt its infrastructure, which is a painful but correct call when you don’t know what an attacker can still reach. GitBook believes the attack was aimed at a single customer, but is treating all customer data as exposed. That includes API and integration tokens, session signing secrets, and, most concerning, the ability to act as the GitBook app in any GitHub or GitLab repositories customers had connected to it. GitBook says it can’t determine whether the attacker took any action in those repositories.

Each step in that chain is a familiar mistake, but strung together they go from a login bug to the source code repositories of GitBook’s customers. GitBook has already rotated the keys for its GitHub and GitLab sync, but if you use GitBook, create new API tokens and rotate any integration secrets, and if you’ve connected it to your repositories, review recent commits and pull requests made by the GitBook app.

GhostMap crashes Android until you wipe it

Bitdefender has found a way to lock an Android phone into a crash loop just by installing an app. The app requests no permissions, contains no code, and never has to be opened. A core system process reads a malformed file inside the app, crashes, restarts, reads it again, and crashes again. Rebooting doesn’t help, and neither does safe mode; the only fix is a factory reset, unless USB debugging was already enabled and you can race the crashes to delete the file over ADB.

An Android app (APK) is really a ZIP file, and ZIP files store the same information, like file sizes and compression methods, in several places without requiring that they agree. Android reads each app many times, with separate pieces of code, to check its signature, install it, load its resources, and run it. When those readers disagree about what a file contains, you get bugs; past examples include the “Master Key” bug (CVE-2013-4787), where Android checked the signature of one file and installed a different one with the same name, and Janus (CVE-2017-13156), where a single file could be both a validly signed APK and executable code at the same time. In this case, Android’s ZIP library only checks the declared uncompressed size against the real file for entries marked as uncompressed, while the code that loads app resources treats anything not marked as compressed as uncompressed. An entry with an unusual compression method and a bogus size slips between the two, Android maps memory past the end of the file, and the process crashes when it tries to read it.

Bitdefender found the bug when a banking malware sample, mangled by a packer, crashed its analysis systems, and reproduced the crash loop on a Pixel 10 running Android 17 with the August 2026 security patch; it affects Android 10 and newer. Google closed the report as not a security issue, and says it has passed it on to a feature team. A phone that can be bricked by a zero-permission app sounds like a security issue to me, and Bitdefender points out that Google rated a similar factory-reset bug as a security fix back in 2016. Be careful what you sideload.

Follow-ups: eMudhra, freezers, and MPTCP

eMudhra has published its full post-incident report, and the Indian Express has a summary of how its certificate authority ended up with private keys as small as “4”. The keys were generated correctly in a hardware security module, but eMudhra needed to move them to new facilities in the US and EU, and wrote its own Python script to wrap and unwrap them for transport. During a rehearsal in April 2025, the script read the unwrapped key back incorrectly, truncating it, and created a new key from the result. Nobody checked the key strength or compared the certified public key to the original, the bad copy had an almost identical label, and the weak certificates passed two audit cycles. eMudhra also revealed it revoked eight more RSA keys on November 7, after previously saying they were unaffected, because it can’t show they were handled properly. BleepingComputer notes that the problem could have been caught more than a year earlier: in June 2025, eMudhra noticed certificate revocation lists signed with keys that didn’t match its CA certificates.

The fallout makes a good case for taking revocation more seriously. Ubuntu 26.10 has started rolling out upki, a Rust project which brings browser-style certificate revocation checking to the rest of the operating system, starting with curl, with OpenSSL support planned for 27.04. And in a lighter take, a thread on Mastodon demonstrates “vanity” RSA keys with readable messages embedded in the public key, including “A certificate authority almost got away with the number 4”.

In more serious follow-ups, France has formally accused Iran’s Islamic Revolutionary Guard Corps of the supermarket refrigeration attacks last month. Foreign Minister Jean-Noël Barrot called it “the first large-scale cyber-attack aimed at sabotage on our national territory,” summoned the Iranian ambassador, and promised sanctions, and the Paris prosecutor has opened an investigation into the head of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at US water utilities, and two of his deputies. Iran’s foreign ministry has rejected the accusation. It’s still not known whether the attacks elsewhere in Europe that we covered last week are related. Researchers have also found multiple exploitable vulnerabilities in the control software of the freezers, beyond the risk of default passwords, but all the articles referencing them appear to be paywalled at the moment.

Finally, Ubuntu now lists fixed kernels for the Linux MPTCP remote code execution bug from last week on 22.04, 24.04, 26.04, and 26.10. Fixes for the older 16.04, 18.04, and 20.04 releases are still in progress. Red Hat has raised its rating to Critical and has been shipping fixed kernels for RHEL 8, 9, and 10 since November 1, with OpenShift updates following this week. Both Red Hat and Ubuntu now stress that the bug isn’t specific to MPTCP. MPTCP only comes into it because that’s what Anthropic’s exploit used, so turning MPTCP off isn’t a fix, and Red Hat says OpenShift nodes in their default configuration, with MPTCP disabled, are still affected.

The good news, for now, is that nobody else seems to have a working exploit. Anthropic still hasn’t released its exploit, and as of October 30 TuxCare hadn’t reproduced it, and no independent public reproduction had turned up. The closest thing public is a proof-only PoC on GitHub which wins the race and detects the kernel leaking freed memory into a SYN-ACK, but stops well short of code execution. The Stack and BleepingComputer both report no confirmed exploitation in the wild, and the bug still isn’t in CISA’s KEV catalog. The scanning Hutchins saw last week suggests someone is preparing for the day a working exploit shows up.

Making Firefox harder to fingerprint

Browser fingerprinting identifies a browser without cookies, by combining lots of individually boring details: installed fonts, screen size, graphics hardware, how the audio system rounds numbers, and so on. Back in August, we saw AliExpress using audio fingerprinting to identify visitors. Mozilla has now published research, accepted at the ACM CCS conference, measuring which details actually make Firefox users unique, using data from almost 25 million users collected through privacy-preserving relays.

The research is behind a set of fairly small changes, shipped over the past year starting with Firefox 143, which add up. Firefox hides the size and position of the taskbar or dock from screen size measurements, reports the number of CPU cores as either 4 or 8 instead of the real count, and fixes inconsistencies in image rendering, Web Audio, and math on Android that made some users stand out. According to the study’s companion site, the percentage of users who could be uniquely identified by the most effective of three commercial fingerprinting scripts dropped from 75% to 46%. Some protections are only on by default in Private Browsing and Strict tracking protection for now. The site also has a test you can run to see how unique your own browser looks.

Funding post-quantum certificates

Let’s Encrypt has received more than €1 million from Germany’s Sovereign Tech Agency to build a Merkle Tree Certificate authority, its largest single investment in post-quantum readiness so far. Post-quantum signature algorithms are much larger than the ones used today, and replacing every signature in a TLS handshake with a post-quantum one would push the handshake well past 10 kilobytes, slowing all connections and breaking others. Merkle Tree Certificates keep things small by covering a whole batch of certificates with a single signature. The funding runs through the end of 2027, covering standards work and a production launch.

Incident response is a growth industry

Vanderbilt University told everyone on campus to shut down university devices and disconnect from university WiFi on Monday while it responds to an active cybersecurity incident, and to report anything suspicious from a separate device. Vanderbilt Health, which is a separate organization, says its systems haven’t been affected. On Tuesday, a ransomware group calling itself BYOD claimed the attack, and says it stole Social Security numbers and records for more than a million students and employees. Vanderbilt hasn’t commented on the claim.

If it feels like these announcements are getting more common, Sophos agrees. In a post on incident response demand, it argues that AI is less about new kinds of attacks and more about attackers running the same playbook faster and at larger scale, while defenders can’t patch at the same speed. Sophos says two thirds of the intrusions it investigated started with compromised credentials or other identity attacks, and attackers reached Active Directory in an average of under three and a half hours. Everyone, it says, is hiring incident responders.