[ <- back-issue archive · live wire · issue #1 · HUB 24H · 2026-11-14 08:54 UTC ]
 .-.                   .-. 
(: `-------------------' :)
 )   intel brief // #1   ( 
(: .-------------------. :)
 `-'                   `-'
> /var/archive/digest/1.intel :: [ 2026-11-14 08:54 UTC ]
  • No news, blog, podcast, or tweet items landed in this 24h window -- signal is 100% GitHub telemetry, so treat the below as code-level, not narrative-level, intelligence.
  • The single most actionable drop is [@xssdoctor] new repo git-cve-2026-113408-poc: a loopback smart-HTTP fixture proving a Git client will accept an unsafe *unborn HEAD symref* from a protocol-v2 server, letting branch-update resolution escape the .git directory.
  • [@vitorfhc] updated vdet, a "negative-day" hunter that watches major OSS projects for *silent* security patches -- fixes shipped before a CVE exists -- and then checks exploitability. This is the highest-leverage recon concept in the window.
  • [@google] goonami-scanner continues its shift away from legacy binproto signature/hash blobs toward a *declarative* engine, with the webidentity fingerprinter migrated to declarative config -- fingerprint-as-data, not fingerprint-as-code.
  • Graphics attack surface churn: google/dawn adds D3D11 import of Y410 shared texture memory as RGB10A2Unorm, and google/angle now invalidates the D3D11 swizzle cache on PBO fast unpack -- both are cross-format/cross-process state-reuse territory in the WebGPU/WebGL stack.
  • [@caido] shipped a coordinated wave: sdk-js prepped for v0.59.1, docs added for the new *capture menu* and HTTP History highlight colors, plus mise-toolshed enforcing SHA-256 checksum verification, lockfiles, and *minimum release age* on installed tools.
  • [@danielmiessler] SecLists pushed another automated Trickest wordlist sync and Fabric kept moving -- useful, but also a reminder that auto-ingested wordlists are an unaudited trust boundary.
  • [@google] nomulus capped domains loaded per list_domains request and marked EAP/XAP fees non-standard/non-refundable -- classic resource-exhaustion and business-logic knobs in a live TLD registry.
 .-.                     .-. 
(: `---------------------' :)
 )   possibilities // #1   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/1.possibilities :: [ 17 sources ]
  • Hunt the Git unborn-HEAD symref path escape directly [@xssdoctor]: stand up a malicious protocol-v2 server, serve a symref pointing at ../../, and test every consumer that clones from semi-trusted origins -- CI PR checkouts, mirror sync jobs, dependency bots, submodule and worktree resolution. Then chain the write-outside-.git primitive to core.hooksPath/config injection for RCE.
  • Build a lightweight negative-day pipeline [@vitorfhc/vdet]: watch upstream repos with high CVE density, diff commits for bounds checks, added if (!x) return, or sanitizer annotations with no CVE reference, then triage into a PoC harness before advisory publication. The window between silent patch and CVE is the alpha.
  • Audit WebGPU/WebGL texture-import paths [@google/dawn, @google/angle]: fuzz SharedTextureMemory import with mismatched format pairs (Y410 → RGB10A2Unorm is a canonical type confusion), and probe whether PBO fast-unpack can read stale swizzled state from a prior draw -- cross-origin image-data leak via canvas readback is the payoff.
  • Turn Goonami's declarative fingerprinter into your own plugin [@google/goonami-scanner]: the migration to data-driven webidentity matching means you can ship YAML/JSON detectors for OAuth/OIDC misconfigurations (permissive redirect_uri, alg:none, unvalidated id_token claims) without touching Go code.
  • Weaponize Caido's new capture-menu and highlight APIs [@caido/sdk-js 0.59.1]: build an extension that auto-tags high-value traffic by response class and replays captured requests with mutated auth context -- cheap, high-throughput differential-auth testing in a live proxy session.
  • Copy mise-toolshed's defense as an attack lens [@caido/mise-toolshed]: any pipeline enforcing *minimum release age* + checksum pinning is explicitly blocking fast supply-chain poisoning of fresh releases. Map which of your targets' CI stacks do and don't, because the unprotected ones are the injection candidates.
  • Fuzz ML model parsers through dimension-mapping arithmetic [@google/XNNPACK]: output_slice dimension mapping fixes and float zero-point blockwise dot changes are exactly where malformed TFLite RESHAPE/SLICE/FULLY_CONNECTED params produce OOB reads. Aim at mobile app model loaders, not the library itself.
  • Probe registry API pagination and fee logic [@google/nomulus]: list_domains per-request caps suggest the pre-fix behavior was unbounded -- look for equivalent unbounded list/export endpoints elsewhere, and test EAP/XAP fee state transitions for free-registration or refund double-spend logic bugs.
 .-.                    .-. 
(: `--------------------' :)
 )   github brief // #1   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/1.github :: [ code & repo tradecraft ]

Across this window the tracked researchers split cleanly into two camps: large-vendor engineering repos doing routine, security-adjacent maintenance, and a thin but sharp layer of individual researchers dropping genuinely offensive primitives. Google's cluster (XNNPACK, dawn, angle, xls, grain, mug, nomulus) shows steady defensive hardening -- swizzle-cache invalidation, texture-format import handling, request-size caps, dimension-mapping correctness -- which reads as an implicit map of surfaces they consider fragile. The real signal sits in the small repos: xssdoctor/git-cve-2026-113408-poc is a working harness for a client-side path escape via protocol-v2 symrefs, and vitorfhc/vdet codifies the negative-day/silent-patch hunting methodology. Caido's push wave (SDK 0.59.1, capture-menu docs, checksum-and-minimum-release-age tooling) and Daniel Miessler's automated SecLists sync round out a window dominated by tooling maturity and supply-chain hygiene rather than new exploit code. Two trends stand out: detection logic is migrating from compiled signatures to *declarative data* (Goonami's webidentity fingerprinter), and release integrity is being enforced by install-time policy (minimum release age, SHA-256 refusal) -- both of which attackers must now route around.

  • Inspect xssdoctor/git-cve-2026-113408-poc first -- it is the only repo here containing a reproducible security bypass, and the smart-HTTP fixture is directly reusable for testing your own targets' clone paths.
  • Clone and run vitorfhc/vdet; its silent-patch detection model is the most portable offensive concept released in this window.
  • Read google/goonami-scanner's declarative webidentity engine before writing custom fingerprint plugins -- leverage their schema rather than rebuilding it.
  • Note caido/mise-toolshed as a blueprint: minimum release age plus checksum refusal is the emerging standard your CI-dependent exploits will have to defeat.
  • Treat danielmiessler/SecLists' automated Trickest sync as an unaudited input channel -- verify upstream diffs before trusting new wordlists in automated pipelines.