.-. .-. (: `--------------------' :) ) intel brief // #16 ( (: .--------------------. :) `-' `-'
- gVisor device-cgroup confinement + filestore cleanup -- Google's sandbox kernel quietly confined the sandbox to a device cgroup and patched a missing filestore cleanup path in the same stretch (heads e45d53c7, ab5f509c). When a sandbox maintainer plugs a descriptor/file lifecycle leak without a bulletin, assume somebody worked out how to hold a filestore handle open across container teardown and keep poking at the host from a half-dead sandbox. Worth a 10-minute diff [google/gvisor].
- Git unborn HEAD symref escape, CVE-2026-113408 -- @xssdoctor shipped a loopback protocol-v2 smart-HTTP fixture proving a git client will accept an unsafe unborn HEAD symref from a server, letting branch-update resolution escape the
.gitdirectory (symref -> path escape outside .git). Clean, inert oracle you can run locally in five minutes. No network, no payload [@xssdoctor]. - CSP allowlists turned into credential exfil pipes -- @albinowax showed that an allowlisted host serving JSONP, uploads, or open redirects turns blocked XSS right back into token theft ('Blind trust'). Vendors still pitch CSP like a magic seatbelt; on most prod targets it's just a pre-approved exfil list [James Kettle / @albinowax].
- Brotli shared-dictionary state loss on serialized parse failure -- commit 6a14c079 fixes a decoder that drops dictionary state when a serialized parse fails, plus mutex synchronization bolted onto BrotliInputStream. Concurrent decompression correctness fixes in a 15k-star library usually mean somebody watched state corrupt under thread contention. Diff the TS bindings against the C core for the same gap [google/brotli].
- WordPress weekly: 497 vulns across 312 plugins -- 218 researchers dumped nearly five hundred plugin disclosures in one week; the volume alone tells you where the cheap bug-bounty surface lives. Pick any unpatched arbitrary file-upload or stored-XSS plugin from the list and go hunting before vendors 'fix' it [Ram Gall / Wordfence].
- Critical Apache HTTP/2 RCE, CVE-2026-119618 -- remote code execution in Apache HTTP/2; WordPress owners on shared Apache hosts are at the mercy of their provider applying the patch. If you run bug bounty against Apache-fronted targets, fingerprint http2 build versions before the fleet catches up [Ram Gall / Wordfence].
- gwpsan seccomp/CFI coexistence rework -- commits restructure the seccomp incompatibility check, disable arm64 breakpoints when ignored, and exempt GWPSan interceptors from CFI so both build together. Sanitizer interceptors exempted from CFI is exactly the kind of carve-out that becomes a gadget library if you can reach it [google/gwpsan].
- go-github label-name escaping fix -- the push fixes label-name escaping in URL paths. Path escaping bugs in API client libraries are the classic quiet precursor to SSRF/path-traversal in every downstream automation tool built on them. Grep your tooling for interpolated label names [google/go-github].
.-. .-. (: `----------------------' :) ) possibilities // #16 ( (: .----------------------. :) `-' `-'
- Diff gVisor teardown order for held filestore handles -- pull heads e45d53c7 and ab5f509c, trace which filestore descriptor the cleanup patch closes, and try to race container teardown while holding an fd into the host-visible mount. Sibling runtimes (Kata, Firecracker's jailer) likely share the same lifecycle gap [inspired by google/gvisor].
- Replay the unborn HEAD symref against other git frontends -- take the CVE-2026-113408 harness, swap the loopback server for protocol-v0/v1 responses, and point it at libgit2, dulwich, go-git, and every CI checkout runner; each implements symref resolution independently and probably trusts the server the same way [inspired by xssdoctor/muse-repo-import-control-20261114].
- Fingerprint CSP allowlists for exfil gadgets -- scrape target CSP headers, resolve every allowlisted origin, and probe each for JSONP endpoints, open redirects, upload paths, or any reflected-content route; one gadget turns a 'blocked' XSS into full credential theft [inspired by portswigger.net].
- Hammer Brotli concurrent decompression for state corruption -- grab commit 6a14c079, revert the mutex locally, and race BrotliInputStream across threads with a shared dictionary and truncated serialized streams; if state loss is reachable pre-patch, look for the same unsynchronized path in the C library's other bindings [inspired by google/brotli].
- Audit gwpsan's CFI-exempt interceptors as a gadget surface -- diff which interceptors got the CFI exemption, then check whether a corrupted vtable or attacker-controlled function pointer inside the sanitizer's intercept path skips CFI enforcement entirely on production binaries [inspired by google/gwpsan].
- Hunt unpatched plugins from the Wordfence 497 -- cross-reference the weekly disclosure list against live WordPress installs via fingerprintable plugin versions; the arbitrary file-upload and privilege-escalation entries are your fastest pre-patch payout window [inspired by wordfence.com].
- Probe go-github label escaping in downstream automation -- the URL-path escaping fix suggests label names with
/,?, or#previously broke or redirected requests; test every tool that interpolates user-controlled repo/label names through go-github for path traversal into other API endpoints [inspired by google/go-github]. - Recreate ANGLE texture-ID churn under teardown contention -- commits recreating texture IDs before glTexStorage hint at stale-handle reuse; diff the D3D11 and Vulkan backends for the unpatched twin and hammer texture destroy/recreate ordering under thread contention [inspired by google/angle].
.-. .-. (: `---------------------' :) ) github brief // #16 ( (: .---------------------. :) `-' `-'
Quiet stretch on the news wires, which left plenty of room to watch what people were actually pushing to git at 2 AM. Two threads ran through the diff stream: Google's sandbox, GPU, and compiler maintainers quietly bolting locks onto container and decompression state, and @xssdoctor shipping a seven-repo controlled experiment matrix probing Muse's repo-import and package-install behavior -- transitive lifecycle execution from a pinned dependency, root-package postinstall, submodule recursion, nested Git config handling, and an inert import control. Every fixture is deliberately non-malicious: marker-file oracles only, no network, no subprocess, no symlinks. No conferenceware, no hype -- just clean harnesses and suspect patch diffs worth pulling tonight.
- xssdoctor/muse-dependency-lifecycle-parent-20261114 -- parent JS package ships zero pre/install/postinstall hooks but pins a researcher-owned dependency at a fixed commit, testing whether Muse's install still executes transitive lifecycle code. Clean supply-chain oracle.
- xssdoctor/muse-dependency-lifecycle-leaf-20261114 -- companion leaf whose postinstall writes a marker strictly inside its own package dir -- no network, no subprocess, no symlink. The detectable payload proving whether lifecycle scripts actually ran.
- xssdoctor/muse-root-lifecycle-control-20261114 -- inert control asking whether Muse's build runs a root-package lifecycle script after inspecting the Git tree; bun install writes a marker and the build refuses to proceed without it, making execution observable.
- xssdoctor/muse-git-nested-config-bypass-20261114 -- minimal nested repo-shaped directory at vendor/lib, no scripts, symlinks, or submodules, built to exercise nested Git config handling in a sanitizer. Zero stars, zero payload, pure signal.
- google/gvisor -- cgroup fixes, missing filestore cleanup, and explicit confinement of the sandbox to a device cgroup (heads e45d53c7, ab5f509c) -- precisely the class of change that closes, or accidentally opens, container-escape and fd-leak paths. Pull the diff before the next bulletin explains it for you.