by sig9
Hacker Wars - November 05, 2026
Your daily dose of infosec chaos
Networking gear that patches itself halfway, AI that roots Linux faster than you can triage, and White House devices quietly moonlighting as someone else’s proxy exit. On the softer side, Apple wants to look at what you share publicly and an Android bug turns phones into boot-loop bricks. Quite the mix - pour something strong.
Zyxel GS1900 Fix Fails To Stop Root-Level Zero-Day
Attackers have been hacking GS1900 switches by the hundreds through a pre-auth flaw in the web management interface, and Zyxel’s first patch apparently fixed the concept of the bug rather than the bug itself - researchers showed the same exploit still lands root commands. Roughly 1,000 switches already had their configs and credentials stolen, and “we patched that” is doing a lot of unearned comforting here.
What to do: Apply Zyxel’s newest firmware, pull switch management interfaces off the open internet, and re-verify patches with an actual exploit test, not a version string.
Apple To Scan Public iCloud Shares For Harmful Content
Starting with the next OS releases, Apple will check publicly shared iCloud Photos and iCloud Drive links against known harmful content - the catch being that “public share link” is a very wide net on a service with over a billion users. It is framed as safety, not surveillance, but the pipeline that hashes your shared content today can be pointed at other content tomorrow - and your data governance policy should already assume cloud providers can see what you upload.
What to do: Review which files and photo albums are shared via public links, assume shared does not mean private, and keep anything sensitive in end-to-end encrypted channels instead.
AI Pipeline Finds 948 Ways To Root Linux - Then Patches Them
OpenAI detailed a pipeline using an upcoming cyber-focused model that triaged thousands of kernel findings and validated 948 local privilege escalation bugs in about 30 hours of compute, at a cost of 1.2 million dollars in API credits. The double edge is obvious: the same pipeline that auto-patches your kernel will happily rent itself to the other side, and the era of “only nation-states find kernel LPEs at scale” just ended quietly.
What to do: Prioritize kernel patching in your vulnerability SLAs now, and expect LPE exploit availability - and attacker patience - to drop sharply.
White House Staffers Renting Out Their Internet Addresses
Researchers found several White House devices running residential proxy software, which quietly turns them into exit nodes that anyone can rent - including, apparently, a service with Russian ties, because opsec failure is truly bipartisan. Whatever the staff thought they installed, the effect is that White House IP addresses are available to whoever pays, which is a gift to anyone who wants their traffic to look like it came from the government.
What to do: Enforce application allowlisting on managed devices and hunt for proxy and VPN binaries across your fleet - “helpful free bandwidth apps” are a common disguise.
GhostMap Android Flaw Turns Phones Into Boot-Loop Bricks
A flaw dubbed GhostMap lets a zero-permission app corrupt Android’s location subsystem so thoroughly that the device boot-loops forever, and the only fix is a factory reset - no permissions, no interaction beyond installation. For enterprises this is less “annoying phone bug” and more “one malicious sideloaded app from a fleet of paperweights,” especially for devices used in the field or as kiosks.
What to do: Block sideloading on managed Android devices, keep Google Play Protect on, and make sure device backups exist before you need them.
That’s the chaos for today. Stay sharp out there.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.