[ <- back-issue archive · live wire · issue #10 · HUB 7D · 2026-11-14 16:04 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #10   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/10.intel :: [ 2026-11-14 16:04 UTC ]
  • Apache HTTP/2 CVE-2026-119618 is a straight remote-code-execution hole -- memory handling in the h2 stack gives an unauthenticated peer a path to code execution on the worker; anyone running WordPress behind Apache needs to confirm the host actually rebuilt the module, not just nodded at the changelog. 'Confirm your host applied the fix' is doing a lot of load-bearing work in that PSA [Ram Gall / Wordfence].
  • CSP allowlists quietly turned into credential-exfil pipes -- @albinowax walked allowlisted hosts serving JSONP, uploads, or open redirects and showed that a blocked XSS just walks around the policy through a domain you told the browser to trust. Vendors still pitch CSP as a seatbelt; on real targets it reads like a pre-approved exfil list [James Kettle / @albinowax, PortSwigger].
  • gVisor pins the sandbox into a device cgroup and finally cleans the filestore -- two pushes in the same stretch: cgroup fixes plus a missing filestore cleanup path, then explicit device-cgroup confinement for the sandbox. When a maintainer patches descriptor cleanup without a bulletin, assume somebody worked out how to hold a filestore handle open across container teardown and keep poking at the host from a half-dead sandbox [google/gvisor, heads e45d53c7 / ab5f509c].
  • Git swallows an unborn HEAD symref and resolves out of `.git` (CVE-2026-113408) -- a protocol-v2 smart-HTTP server hands back a symref on an unborn HEAD, and branch-update resolution follows it past the repository boundary (symref -> path escape outside .git). @xssdoctor dropped a loopback fixture that reproduces the whole thing in five minutes, inert, no payload [xssdoctor/git-cve-2026-113408-poc].
  • Brotli loses shared-dictionary state when a serialized parse fails -- commit 6a14c079 fixes a decoder that drops dictionary state on a failed serialized parse instead of unwinding cleanly, and the same push adds mutex synchronization to BrotliInputStream so concurrent readers stop interleaving dictionary installs. Malformed dictionary blobs plus parallel streams is the shape of that bug [google/brotli].
  • Wordfence tallies 497 holes across 312 plugins in seven days -- one theme, 218 researchers credited, plugin-heavy disclosure volume that never slows down. The count is the story: the extension layer is still where the cheap bugs live [Ram Gall / Wordfence Intelligence].
  • vdet watches for the fix that lands before the CVE exists -- @vitorfhc's negative-day detector scrapes major open-source projects for silent security patches, then asks the only question that matters -- is the patched path actually reachable and exploitable. That is a pre-CVE hunting pipeline, not a news feed [vitorfhc/vdet].
  • Cloud hacking scope and provider misuse, episode 200 -- Nick Copi walked through where cloud attack surface actually sits and how providers themselves widen or narrow it. Worth it for the threat-model framing alone [Critical Thinking Podcast].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #10   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/10.possibilities :: [ 53 sources ]
  • Diff gVisor's filestore cleanup against every runsc teardown path -- pull the two pushes, grep for other Release/Destroy handlers that skip cleanup on an error return, then hammer container teardown under thread contention while holding a descriptor open from inside the sandbox. Sibling targets: the containerd shim, gVisor's own gofer, and any out-of-tree platform shim that mirrors filestore lifecycle [inspired by google/gvisor].
  • Fuzz Brotli's serialized-dictionary parse failure under concurrency -- feed truncated and contradictory dictionary streams, then run several BrotliInputStream readers against a shared dictionary object and watch for half-installed state. Port the same corpus at the Java and Python bindings; the C core got the fix, the wrappers did not necessarily get the lock discipline [inspired by google/brotli 6a14c079].
  • Turn the unborn-HEAD fixture into a client matrix -- point the loopback v2 server at libgit2, go-git, JGit and the credential helpers, and test clone --recurse-submodules plus fetch against a symref that walks upward. Also try a post-checkout hook ordering variant on Windows path handling, where ..\ escapes get normalized late [inspired by xssdoctor/git-cve-2026-113408-poc].
  • Trace ANGLE's recreate-texture-IDs-before-glTexStorage fix into Dawn and the Vulkan/Metal backends -- that patch exists because a stale ID survived into a storage allocation. Grab the commit, then hammer texture teardown order and shared-texture import under thread contention in Dawn, where the same swizzle-cache invalidation logic has an unpatched twin [inspired by google/angle, google/dawn].
  • Probe gwpsan's restructured seccomp incompatibility check -- the commit reorders when the tool decides seccomp is incompatible, disables arm64 breakpoints when ignored, and exempts its own interceptors from CFI. If the interceptor can be armed before the filter install decision lands, you get sampling on a process that thinks it opted out. Watch the ordering, not the flags [inspired by google/gwpsan].
  • Mine every allowlisted host for JSONP, open redirects and upload endpoints -- take the target's CSP report, enumerate each allowlisted origin, and hunt the three gadgets that turn a blocked injection into token theft. Report writers still list ad and analytics domains; those are usually the softest entries on the list [inspired by James Kettle / @albinowax].
  • Fuzz go-github's label-name path escaping against sibling clients -- upstream fixed label names that broke URL path construction. Same input class exists in octokit and PyGithub; feed ../, %2f, and query delimiters as label names and watch where the request lands [inspired by google/go-github].
  • Chase XNNPACK's float zero-point blockwise dot and output_slice dimension mapping fixes -- both touch index arithmetic on tensor shapes. Build a harness that feeds mismatched zero-point types and sliced dimensions, then diff the sibling microkernel paths for the same off-by-one in dimension remap [inspired by google/XNNPACK].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #10   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/10.github :: [ code & repo tradecraft ]

Dead air on the news side meant the whole week sat in the commit stream, and it split cleanly in two. Google spent it bolting locks onto the layer everything else trusts -- gVisor's device cgroup and filestore cleanup, ANGLE's texture-ID churn, gwpsan's seccomp ordering -- the kind of patches that close a hole quietly and tell you nothing about who already found it. Meanwhile @xssdoctor pushed seven fixtures that ask one boring question each about what a package installer executes when nobody is watching: no network, no subprocess, no symlinks, marker files only. That is the version of this work that survives scrutiny, and it is worth pulling tonight.

  • xssdoctor/git-cve-2026-113408-poc -- loopback protocol-v2 smart-HTTP server that returns an unsafe unborn HEAD symref and proves the client resolves branch updates outside .git. Inert oracle, runs locally, no target required [xssdoctor].
  • xssdoctor/muse-dependency-lifecycle-parent-20261114 + muse-dependency-lifecycle-leaf-20261114 -- the parent ships zero lifecycle hooks but pins a researcher-owned dependency at a fixed commit; the leaf's postinstall writes one marker file inside its own package dir. Clean transitive-execution oracle -- if the marker appears, the installer ran a dependency's install script [xssdoctor].
  • xssdoctor/muse-root-lifecycle-control-20261114 -- bun install writes a marker and the build refuses to proceed without it, making root-package lifecycle execution impossible to hand-wave away. Textbook control design [xssdoctor].
  • xssdoctor/muse-benign-submodule-parent-20261114 / -leaf / muse-git-nested-config-bypass-20261114 -- parent pulls a submodule from the same account that renders one constant; the leaf carries a fixed public marker and a matching JS literal. The nested-config fixture drops a repo-shaped directory at vendor/lib with no scripts at all, purely to see whether a sanitizer recurses into nested git config [xssdoctor].
  • vitorfhc/vdet -- negative-day detector that watches major projects for security patches shipped before any CVE exists, then checks whether the patched path is actually reachable. Pair it with the oss-fuzz-vulns OSV refresh and you get a workable pre-CVE triage loop [vitorfhc, google/oss-fuzz-vulns].