The automated attack may have exposed sensitive artifacts, including Git Sync secrets, customer API tokens, third-party integration credentials, and queries submitted to the GitBook Assistant. In response, GitBook patched the underlying vulnerabilities, replaced its internal infrastructure credentials, and systematically invalidated all customer API tokens across the entire platform. While core operations and cached public docs are back online, users must now manually rotate their external integration secrets.
Key points
GitBook confirmed that no customer documentation or content was modified during the autom…: GitBook confirmed that no customer documentation or content was modified during the automated security breach.
Customers must immediately rotate their third-party API tokens, published integration sec…: Customers must immediately rotate their third-party API tokens, published integration secrets, and GitBook MCP server authentications.
The platform has fully restored core application services and plans to publish a comprehe…: The platform has fully restored core application services and plans to publish a comprehensive post-mortem report.
Sources checked by our analysis pipeline: 1
We opened a ticket with support about Gitbook availability issues and got this in reply. We have yet to see any official customer communication or breach notification. Apologies for the formatting, did the best I could as it's a mobile paste.
Update:
GitBook security incident update
Hey <$name>,
The GitBook app, the GitBook API, and published docs are available again. A few services may still be degraded as we finish restoring everything to full performance.
*What happened*
GitBook has been the target of a sophisticated, highly targeted attack using AI agents.
At 19:00 CET, November 2, the attacker gained unauthorized access to some of our infrastructure credentials. We detected the attack immediately and acted swiftly to block further impact.
To make sure our infrastructure was fully secure, we then took the GitBook app and authenticated docs sites offline. We kept publicly published content live for as long as possible, using cached data.
*What we did immediately*
* Blocked the attacker and closed the vulnerabilities involved
* Replaced every credential and secret across our infrastructure
Apple has released a new beta version of iOS that introduces artificial intelligence audio tools. The update also includes new features specifically tailored for China.
The watchOS 27.3 developer beta brings conversational recall tools directly to wearers' wrists by using continuous ambient listening to transcribe and summarize recent speech. Wearers can quickly retrieve missed dialogue or save auto-generated meeting notes within the Siri application. To alleviate surveillance fears, the company handles the continuous mic input entirely on isolated hardware without creating stored audio files.
The social platform is piloting a feature that inserts commercial promotions directly into search queries alongside organic results. Advertisers will target users based on contextual relevance, connecting specific product promotions to user search phrases. The rollout builds on an aggressive series of platform adjustments aimed at monetizing user activity and locking down internal data.