[ <- back-issue archive · live wire · issue #14 · HUB 30D · 2026-11-14 16:17 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #14   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/14.intel :: [ 2026-11-14 16:17 UTC ]
  • WordPress core upgrade-window RCE under active probing -- CVE-2026-119977 is an unauthenticated race condition in the core update process, hitting 4.7 through 7.1.3, fixed in 7.1.4 plus backports. Exploitation attempts were observed within days of release; if you run WP on shared hosting, confirm the host actually pulled the backport [Ram Gall / Wordfence].
  • Kettle's CSP credential theft via 'allowlisted' hosts -- @albinowax showed that a CSP allowlist entry serving JSONP, uploads, or open redirects turns a blocked XSS straight back into token exfil ('Blind trust'). Most prod CSPs are just pre-approved exfil lists [James Kettle / @albinowax].
  • HTTP header injection -> CRLF desync in one step -- Kettle escalated plain header injection into request smuggling by injecting CRLF sequences that desync the front-end, serving random users a redirect to a collaborator host. PortSwigger shipped a scanner check for it; expect a wave of copycat finds [James Kettle / @albinowax].
  • SVG sanitizers are theater -- 'Scalable Vector Grief' -- Kettle bypassed six of eight popular SVG sanitizers using response headers alone to trigger JS execution in Firefox while the body stays benign XML. Sanitizing the markup is not the boundary; the delivery context is [James Kettle / @albinowax].
  • Apache HTTP/2 critical RCE, CVE-2026-119618 -- remote code execution in Apache's HTTP/2 stack; WordPress-on-Apache shops are the loud canary but anything fronting h2 is in scope. Confirm your host patched before you assume [Ram Gall / Wordfence].
  • Brotli shared-dictionary state loss fixed quietly -- commit 6a14c079 patches a decoder that drops dictionary state on serialized parse failure, plus mutex sync bolted onto BrotliInputStream. Recall CVE-2026-111497 ('HTTP2Shell') rode this same library; state-loss bugs in decompression are desync and memory-corruption fuel [google/brotli].
  • gVisor device-cgroup confinement + filestore cleanup -- Google quietly tightened sandbox device-cgroup confinement and plugged a missing filestore cleanup path in the same push (heads e45d53c7, ab5f509c). Descriptor-lifecycle patches without a bulletin mean somebody worked out how to hold a handle across teardown [google/gvisor].
  • 497 WP plugin vulns in one week, 549 the week before -- Wordfence's weekly reports tally ~1,000 disclosures across ~660 plugins in a fortnight from 440 researchers. That's not news, that's a target queue [Ram Gall / Wordfence Intelligence].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #14   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/14.possibilities :: [ 74 sources ]
  • Hunt CSP allowlist gadgets on every bug bounty scope -- pull the CSP header from target responses, resolve each allowlisted origin, and probe for JSONP endpoints, open redirects, upload paths, or any reflected-content gadget. Kettle's method converts a 'blocked' XSS into credential exfil; most programs still pay for it [inspired by James Kettle / @albinowax].
  • Fuzz header injection -> CRLF desync chains on shared front-ends -- grep targets for any user-controlled response or request header reflection, then test CRLF injection to desync front-end/back-end parsing and smuggle a redirect to your collaborator. PortSwigger's new scan check gives you the exact oracle shape [inspired by James Kettle / @albinowax].
  • Re-test SVG upload flows with header-based execution -- stop auditing the XML body; check whether the file is served with attacker-influenced Content-Type/Content-Disposition or via a same-origin context in Firefox. Six of eight sanitizers fell to this; re-run your old SVG reports with the new primitive [inspired by James Kettle / @albinowax].
  • Diff gVisor's filestore cleanup for the pre-CVE escape -- pull e45d53c7 and ab5f509c, identify which filestore handle survived teardown before the fix, and check whether the device-cgroup confinement closes or merely narrows the escape. Sibling sandbox kernels (Kata, Firecracker's virtio paths) deserve the same teardown-order audit [inspired by google/gvisor].
  • Hammer Brotli concurrent decompression for state confusion -- the mutex added to BrotliInputStream implies a real race existed; fuzz shared-dictionary streams under thread contention and serialized parse failures, looking for use-after-reset or dictionary-state confusion that yields desync or OOB reads. Node and Chromium both embed this code [inspired by google/brotli].
  • Race the WordPress upgrade window on unpatched cores -- CVE-2026-119977 is a race in the update process; instrument a local 7.1.3 install, trigger the core update flow under concurrent requests, and map the exact TOCTOU window. Backports exist but shared hosts lag -- that's the wild population [inspired by Ram Gall / Wordfence].
  • Run @vitorfhc's vdet against silent patches -- point the 'negative-day' detector at major OSS projects (gVisor, ANGLE, Dawn, Brotli all pushed this window) to catch security fixes shipped before CVE assignment, then verify exploitability yourself. Pre-CVE hunting is the cheapest edge left [inspired by @vitorfhc].
  • Grep ANGLE/Dawn siblings for stale texture-ID reuse -- ANGLE recreated texture IDs before glTexStorage (head 99a746a6); grep the Vulkan and Metal backends plus Dawn's shared-texture import paths for the unpatched twin and hammer teardown order under GPU process contention [inspired by google/angle].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #14   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/14.github :: [ code & repo tradecraft ]

Quiet on the blogs meant the real signal sat in the git firehose, and two threads ran through it: Google's sandbox and GPU maintainers quietly bolting locks onto state that everything else trusts, and @xssdoctor shipping a seven-repo controlled matrix of deliberately inert fixtures probing exactly what a repo-import and package-install pipeline executes behind closed doors. No payloads, no network, marker-file oracles only -- which is precisely how you build an execution oracle nobody can call malicious. Meanwhile @vitorfhc kept sharpening a pre-CVE silent-patch hunter, and SecLists did its usual automated wordlist churn. Worth a long pull tonight.

  • xssdoctor/muse-dependency-lifecycle-parent/leaf-20261114 -- parent package pins a researcher-owned dependency at a fixed commit with zero hooks of its own; the leaf's postinstall writes one marker file inside its own dir, no network, no subprocess. Clean oracle for whether Muse executes transitive install scripts [xssdoctor].
  • xssdoctor/muse-git-nested-config-bypass-20261114 -- minimal nested repo-shaped directory at vendor/lib, no scripts or symlinks, built purely to exercise nested Git config handling in a sanitizer. If the import path honors a nested .git/config, this fixture will show it [xssdoctor].
  • xssdoctor/muse-root-lifecycle-control-20261114 -- bun install writes a marker and the build refuses to proceed without it, making root-package postinstall execution directly observable after Git-tree inspection. Textbook control design [xssdoctor].
  • vitorfhc/vdet -- 'negative-day' detector watching major OSS projects for silent security patches pre-CVE, then checking whether the fix is actually exploitable. A direct pipeline for pre-CVE hunting; point it at this window's gVisor and Brotli heads first [@vitorfhc].
  • google/gvisor -- cgroup fixes, missing filestore cleanup, and explicit device-cgroup confinement of the sandbox (heads e45d53c7, ab5f509c). Descriptor-lifecycle patches with no bulletin are the classic tell that somebody held a handle across teardown; diff both heads before they get a CVE [google/gvisor].