Daily Briefing for 11.05.26

Top stories.

1. Zyxel fixes an actively exploited zero-day.
2. Multiple Asian airlines disclose third-party breaches.
3. GhostMap can disable Android phones via malicious apps.
4. US government IT worker admits to spying for Ethiopia.

Zyxel fixes an actively exploited zero-day.

Zyxel has released patches for an actively exploited flaw in GS1900 series switches. The vulnerability (CVE-2026-107441) is an out-of-bounds write flaw that can “allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.”

BleepingComputer reports that a Chinese-speaking attacker began exploiting the flaw in August to compromise nearly a thousand Zyxel devices, but researchers initially thought the attacks targeted a separate flaw (CVE-2026-7273) patched by Zyxel in June. Researchers at Binarly discovered in September that these attacks were actually targeting a new, unpatched vulnerability, and Zyxel issued a fix on October 22nd.

Multiple Asian airlines disclose third-party breaches.

Six airlines in Asia have disclosed breaches tied to a cyberattack against Spanish IT provider Amadeus, the Record reports. Japan Airlines says 92,000 customers had their information stolen, Singapore Airlines says 46,000 records were exposed, and Cathay Pacific says 53,000 records were stolen. Korean Air, Asiana Airlines, and Malaysia Airlines have also disclosed that they were affected.

Amadeus provides flight reservation and check-in platforms, and said in a statement that “[c]ertain booking-display data was accessible” via a vulnerability in its environment. The company says the flaw has since been fixed.

GhostMap can disable Android phones via malicious apps.

Bitdefender has published a report on an Android flaw dubbed “GhostMap” that can allow a malicious app to place an Android device into a permanent crash loop. The malicious app does not need to be opened or granted any permissions. Fixing the affected device requires a factory reset, which erases the device’s data.

Bitdefender explains, “The operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length. Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file.”

Google acknowledged Bitdefender’s report but has not issued a security update, referring it for possible future consideration.

US government IT worker admits to spying for Ethiopia.

A US government IT worker has pleaded guilty to sending classified files to Ethiopia. 53-year-old Abraham Teklu Lemma, a naturalized US citizen living in Maryland, held a Top Secret clearance and worked for the US National Reconnaissance Office, the Department of State, and the Department of Justice.

The US Justice Department stated, “From 2021 until his arrest in August 2023, Lemma conspired with senior Ethiopian government officials to collect and transmit dozens of highly classified documents, notes, materials, and photographs, classified up to the Top Secret/Sensitive Compartmented Information (TS/SCI) level, to Ethiopian government officials … Much of the highly classified information Lemma shared with the Ethiopian government concerned an armed conflict in Ethiopia. Lemma’s conspirators included senior officials within political, military, and intelligence branches of the Ethiopian government.”

As part of his guilty plea, Lemma agreed to a prison term between 120 and 262 months.