OpenAI Prototype Finds 948 Linux Exploits as GhostMap Hits Android

OpenAI Autonomous Pipeline Identifies 948 Unique Linux Kernel Exploits

OpenAI's Cyber team disclosed that a five-stage autonomous vulnerability research prototype scanned the 40-million-line Linux kernel in mid-October 2026, identifying 2,308 candidate findings, dynamically reproducing 1,724 vulnerabilities, and generating 948 unique local privilege escalation (LPE) exploits alongside candidate patches, according to OpenAI News.

In the first stage, Scout agents narrowed the audit scope to 5,034 security-relevant targets totaling about 2.8 million lines of code—roughly 7% of the Linux kernel—for $3,426 in API credits. Within 12 hours, Analyst agents produced 2,308 deduplicated candidate findings at a cost of $316,549 in API credits. Over the next 30 hours, triage agents running isolated virtual machines with Kernel Address Sanitizer (KASAN) dynamically reproduced 1,724 vulnerabilities (74.7% of candidates, with only 3.1% reflecting incorrect model analysis) for $73,330 in API credits.

An initial screening agent ($44,194 in credits) narrowed the validated bugs to 313 information leak candidates and 1,238 LPE candidates. ExploitDev agents ($775,929 in credits, including $84,929 for information leaks and $691,000 for LPEs) tested them against SMEP, SMAP, KASLR, and HARDENED_USERCOPY mitigations, producing 291 information leak proofs of concept and 1,169 working LPE exploits corresponding to 948 distinct vulnerabilities at an average cost of $359 per successful exploit ($1,213,430 end-to-end, compared with 166 unique LPEs found by GPT-5.6 Sol in late July 2026 for $513,690). Across 166 sampled exploits, the agents invented 10 novel exploitation techniques, and in a 112-hour run against Google's kernelCTF environment ($32,936 in credits), the pipeline produced 25 information leak proofs of concept, 21 kernel 0-day LPE exploits, and a QEMU TCG exploit. Within 10 days of the mid-October scan, Linux maintainers had already patched 61 LPEs upstream, staged 43 patches, and discussed 299 publicly.

Bitdefender Discloses Unpatched 'GhostMap' Android Boot-Loop Flaw

Romanian cybersecurity firm Bitdefender discovered a denial-of-service vulnerability in Android dubbed "GhostMap" while analyzing an Android banking trojan, BleepingComputer reported. The flaw stems from two Android libraries interpreting ZIP compression methods differently, allowing a malformed APK containing no executable code and requesting zero permissions to map a file into an unallocated memory region and trigger a CPU SIGBUS crash whenever system_server reads the resource upon installation.

On a Pixel 10 running Android 17 with the August 5 security patch, installing the proof-of-concept app triggered a crash loop within one second that repeated 110 times in normal boot mode and 72 times in Safe Mode, blocking Safe Mode recovery and leaving only a data-wiping factory reset or rapid ADB file deletion. Bitdefender reported GhostMap to Google on August 20 and submitted an extended report on August 25 after Google closed the initial ticket as "Won't Fix (Not Reproducible)," with Google reserving it only for future consideration.

Residential Proxies Detected Beaconing from White House Network

Security firm Layer3 Intel and proxy tracker Synthient warned that multiple residential proxy services have been routing external traffic through the internet address network reserved for the Executive Office of the President (AS2650), according to Krebs on Security. Between October 5 and November 3, Layer3 Intel observed proxies exiting the White House network 236 times across six (6) internet addresses on 26 of the 30 days, primarily between 5 p.m. and midnight, across 28 separate residential proxy services.

Synthient linked the activity to Windows 11 installations of Infatica, a proxy program founded by Vladimir Fomenko, whose hosting firm King Servers housed six of the eight IP addresses used to compromise election databases in Arizona and Illinois in 2016. Synthient founder Ben Brundage noted that resellers sell proxy bandwidth for as low as 60 cents per gigabyte, while Spur reported in January 2026 finding residential proxies on nearly 300 government networks, 318 utilities, 166 healthcare organizations, and 141 financial firms, and Infoblox found 65% of its customer base querying residential proxy domains.

Vercel Deploys Device Bound Session Credentials; Amadeus Breach Hits Asian Airlines

Cloud platform Vercel is rolling out Device Bound Session Credentials (DBSC) for vercel.com in Chrome on macOS and Windows alongside DPoP protection for the Vercel CLI, CTO Malte Ubl announced, according to BleepingComputer. DBSC signs session cookies using an unextractable private key stored in a device's Trusted Platform Module (TPM), complementing Chrome's App-Bound Encryption. Following an April security breach stemming from a compromised Context.ai Google Workspace account, Vercel also launched Security Review in public beta for Pro and Enterprise teams, offering free automated GitHub push scans through November 10, 2026.

Meanwhile, six Asian carriers—Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines, and Malaysia Airlines—disclosed customer data breaches stemming from a vulnerability in a travel booking display environment operated by Spanish IT provider Amadeus IT Group (which reported more than $6.5 billion in revenue last year), The Record reported. Japan Airlines reported 92,000 affected customers, Cathay Pacific reported 53,000 stolen records, and Singapore Airlines reported 46,000 accessed records after threat actors used login credentials assigned to a system account. Amadeus confirmed no payment or financial data was accessed and no ransomware was involved, contrasting the incident with a 2025 Qantas breach that exposed 6 million customer records.