hybrid PKE scheme CCA2 insecurity I'm reading "An Efficient CCA2-Secure Variant of the McEliece Cryptosystem in the standard model" by Rastaghi which states:


  As we know, in hybrid PKE schemes XOR alone cannot perfectly hide
  challenge bit to the CCA2 adversary



The author does not define hybrid PKE schemes. What is their definition?
Why is it that XOR alone cannot perfectly hide challenge bit to the CCA2 adversary in hybrid PKE schemes?
The author does not define hybrid PKE schemes. What is their
  definition?


A hybrid public-key encryption scheme is a scheme that uses public-key encryption along with symmetric encryption to gain speed advantages for long messages.

The usual instantiation is to simply encrypt a key for the symmetric scheme and prepend the resulting cipher text. The more modern approach is to choose a random element from the PKE scheme's message space and encrypt it. Then use the hash of said element as the key for the symmetric scheme. This is called the KEM/DEM approach and allows for easier usage of elliptic curves (see ECIES) and code-based crypto (see McBits by Bernstein et al).


  Why is it that XOR alone cannot perfectly hide challenge bit to the CCA2 adversary in hybrid PKE schemes?


This means that the following scheme isn't CCA2 secure. Encrypt by choosing a random key from the PKE's message space use this key as one-time-pad, prepend the random key - encrypted with the PKE. Decrypt by decrypting the random key with the PKE and then use the result to decrypt the data with the OTP. Note: The OTP could be replaced by a stream cipher and the key may also be the result of a key-derivation function.

You see what is missing here? The message is not authenticated. 

Say you're given a cipher text $c$ for an unknown message $m$ to be decrypted (if you can you win the CCA2 experiment). Suppose further that $c=(E_{PK}(k),H(k)\oplus m)$ which is standard construction for this. Note that $H(k)=k$ is allowed. Now randomly choose a $r$ of length $||m||$ and compute $c'=(E_{PK}(k),H(k)\oplus m\oplus r)$. Note that $c\neq c'$. Now query the decryption oracle for $c'$ and obtain $m'=m\oplus r$. Now finally reconstruct the message $m=m'\oplus r$ and you have "won" the CCA2 experiment.