GhostMap Vulnerability Forces Android Devices into Unrecoverable Boot Loops
Bitdefender researchers have disclosed GhostMap, a vulnerability that traps Android devices in an endless boot loop after a specially prepared application is installed on the system.
The flaw requires no permissions, no user interaction, and no executable code inside the APK. It is sufficient for the malformed package to reside on the device for the system_server process to begin crashing repeatedly.
The root cause lies in divergent interpretations of ZIP archive parameters by different system libraries. When a corrupted resource is read, the process terminates. Android then restarts system_server, which immediately attempts to access the same file and crashes again, creating an unrecoverable cycle.
The vulnerability affects devices starting with Android 10. Researchers reproduced the loop on a Google Pixel running Android 17 with the security patch dated 5 August 2026. Safe mode does not interrupt the sequence.
Restoration typically demands a factory reset, resulting in the loss of all locally stored data. In some cases, the problematic file can be removed via ADB, but USB debugging must already be enabled and the intervention window is narrow.
No patch is currently available. Google initially marked the report as unreproducible; after a second submission the issue was forwarded to the relevant team for possible remediation in a future release. Bitdefender has not observed any active exploitation of this boot-loop technique.
Related articles
sshhole: OpenSSH Authentication Bypass on musl libc Systems Without PAM
An emergency patch for OpenSSH 10.6p2 was released on November 5, 2026, to fix a critical authentication bypass vulnerability affecting Linux systems using musl libc without PAM support. The flaw allowed attackers to log into accounts with a locked password by supplying any string longer than 256 bytes. The root cause traces back to a chain of engineering decisions: musl's crypt() returning '*' on length errors instead of NULL, OpenSSH's 2016 timing attack mitigation that selected salts from real hashes, and the resulting strcmp match between error result and the shadow '*' marker. Exploitation required a specific combination of musl, OpenSSH without PAM, password authentication enabled, and an account marked with '*' in /etc/shadow, notably impacting Alpine Linux cloud images. The vulnerability was discovered by researcher Özgün Kültekin using LLM-assisted fuzzing of 17,600 authentication variants. OpenSSH 10.6p2 or equivalent distribution patches close the issue; until applied, administrators should set PasswordAuthentication no where password login is unnecessary.
Critical Command Injection Vulnerability in SolarWinds Dameware Enables Remote System Compromise
SolarWinds disclosed CVE-2026-28336, a critical command injection flaw in its Dameware remote support tool on November 3, 2026. Rated 9.9 out of 10, the vulnerability allows an authenticated user to execute arbitrary commands on remote systems managed by the software. The issue stems from insufficient input validation when user-supplied data is passed to the operating system, enabling attackers to append malicious commands. Exploitation requires only a valid, even low-privileged, Dameware account and occurs over the network with low complexity and no user interaction. The flaw affects version 2026.3 and all prior releases, with a fix available in 2026.3.1. SolarWinds also recommends reviewing account lists and restricting network access to administrative segments. This marks the latest in a series of security issues for the vendor, following a privilege escalation fix in 2025 and patches for fifteen Serv-U vulnerabilities in July.
CISA Adds Apple CVE-2024-27834 to Known Exploited Vulnerabilities Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added the Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation. The flaw impacts multiple Apple platforms including iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It is an authentication bypass issue that can be exploited for arbitrary read and write operations when an attacker already possesses initial access rights. The vulnerability was discovered and patched in 2024, yet exploitation activity has now prompted federal action. NIST rates the issue at CVSS 5.5 Medium. U.S. federal agencies are required to apply mitigations by November 18.
Ruby on Rails Releases Security Updates Fixing 21 Vulnerabilities Including Critical Active Storage Flaw
The Ruby on Rails development team has issued security updates for versions 8.1.4.1 and 8.0.5.2 that address a total of 21 vulnerabilities. One issue rated critical affects the Active Storage component when ImageMagick is used for image processing. The flaw tracked as CVE-2026-122006 carries a CVSS v3.1 base score of 9.8 and could allow arbitrary file writes or data exfiltration from untrusted uploads. Additional high-severity problems enable remote code execution, arbitrary file reads, parameter validation bypass, IP spoofing, cross-site scripting, and denial-of-service conditions. The 8.0 branch will reach end of security support on November 7, 2026, after which no further fixes will be provided. Administrators are strongly advised to apply the patches immediately.