[ <- back-issue archive · live wire · issue #20 · HUB 24H · 2026-11-14 22:17 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #20   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/20.intel :: [ 2026-11-14 22:17 UTC ]
  • CVE-2015-10149 -- Dancer session ids go straight to the engine -- Dancer <1.3400 for Perl passes the session cookie's id into the session engine with zero validation, so a crafted cookie pokes directly at whatever backing store sits behind it (YAML, DBI, whatever the app wired up). Eleven-digit CVE number on a decade-old bug class; filter those ids before they hit the engine or upgrade past 1.3400 [oss-security].
  • CVE-2026-128240 -- GPAC use-after-free in gf_sg_proto_del -- MP4Box through 26.07.0 frees prototype scene-graph nodes during XMT scene teardown and then keeps using them (CWE-416, CVSS 5.5, AV:L/UI:R, crash-only per the advisory). Fixed in a2e5c62c -- pull that commit and check whether 'crash-only' survives a heap-grooming pass [oss-security].
  • Cursor marketplace breach via stolen Fireworks AI credentials -- attackers lifted credentials from Fireworks AI and pushed a malicious Claude Code extension through Cursor's marketplace, a clean supply-chain hijack of the editor auto-fetch path. Audit what your editor silently installs; the trust boundary here was a vendor pipeline, not the user [BleepingComputer].
  • DPRK 'FaceStealer' disruption -- expect retooling, not retirement -- US infrastructure takedown hit the crew behind $400M+ in spoofed-identity crypto theft. Disruption ops rarely kill the playbook; the same lures and fake-recruiter personas will rotate onto fresh infra inside a month [BleepingComputer].
  • gVisor tightens proc-umount and child-netns loopback -- google/gvisor merged proc-umount process-handle work, host-net child netns loopback handling, and file-lock wait registration in one push. Sandbox maintainers patching descriptor and netns seams quietly usually means somebody was holding a handle across teardown -- worth a diff [google/gvisor].
  • osv.dev locks Cloud Run to least-privilege and fixes RPM version ordering -- the vuln DB itself got hardened: least-privilege service account on Cloud Run, plus corrected RPM version comparisons for TuxCare/CentOS/OracleLinux/RHEL. Version-ordering bugs in a triage service mean missed or false matches feeding every downstream consumer [google/osv.dev].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #20   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/20.possibilities :: [ 106 sources ]
  • Heap-groom the GPAC XMT teardown UAF past 'crash-only' -- grab fix a2e5c62c, diff gf_sg_proto_del's free order, and fuzz XMT/BT scene inputs with controlled allocation churn between node deletion and reuse; sibling scene-graph code in libgpac's BIFS and VRML paths likely shares the teardown pattern [inspired by oss-security GPAC advisory].
  • Poke Dancer session engines with crafted cookie ids -- enumerate Dancer::Session::YAML/DBI backends, feed path-shaped and format-shaped session ids from the cookie, and watch for traversal or deserialization in the engine layer; then sweep sibling Perl frameworks (Mojolicious, Catalyst) for the same unvalidated-id handoff [inspired by oss-security Dancer advisory].
  • Audit editor extension marketplaces for auto-fetch trust gaps -- the Cursor/Fireworks chain shows a stolen vendor credential -> marketplace publish -> client auto-install path; map which marketplaces sign packages, which just gate on publisher auth, and whether pinned versions can be silently swapped post-publication [inspired by BleepingComputer Cursor breach report].
  • Diff gVisor's proc-umount handle work for escape primitives -- the process-handle and child-netns loopback merges touch exactly the seams where a sandboxed process can hold references across namespace teardown; build a repro that forks, umounts /proc, and races netns creation to see if stale handles leak host context [inspired by google/gvisor].
  • Hunt negative-day patches with videt's methodology -- vitorfhc/videt watches major OSS repos for silent security fixes landing before a CVE is assigned; point it at high-value targets (GPAC, ImageMagick, curl) and race the window between fix commit and advisory publication [inspired by vitorfhc/videt].
  • Fuzz rtl_433's shrunk MAXIMAL_BUF_LENGTH -- the recent commits shrank the maximal buffer and reworked SDR reopen/connection-handler teardown; feed oversized or malformed ISM frames at the new boundary and hammer the mg_mgr_free() shutdown path for use-after-free on the socket handlers [inspired by merbanan/rtl_433].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #20   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/20.github :: [ code & repo tradecraft ]

Thin news wire tonight, but the git pushes at 2 AM carried real weight: SDR and wardriving maintainers quietly hardening buffer and teardown paths, a negative-day CVE hunter getting fresh commits, and sandbox kernel work landing without a bulletin. Nothing here is conferenceware -- just teardown-order fixes, buffer shrinks, and one Rust tool that turns silent patches into hunting leads.

  • merbanan/rtl_433 -- ISM-band decoder commits shrink MAXIMAL_BUF_LENGTH, fix getopt reset/%z on newlib/ESP-IDF, reopen SDR cleanly, and silence connection handlers before mg_mgr_free(). Buffer-boundary and shutdown-order changes in a packet parser are a standing invitation to fuzz.
  • vitorfhc/videt -- watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Negative-day window between commit and advisory is where bug bounty money lives; small repo, sharp idea.
  • kismetwireless/kismet -- baseline-transport merge adds rules that baseline aircraft and ships for the current run only, with matching docs in kismet-web-docs. ADS-B/ship AIS filtering logic worth reading if you run Kismet near an airfield or port.
  • portapack-mayhem/mayhem-firmware -- HackRF+PortaPack firmware fixes stale audio spectrum updates during modulation changes and extends PRALINE TX/RX clock synchronization. TX/RX clock sync work on an RF transmitter is the seam where spurious emissions live.
  • JorianWoltjer/responder -- query-param PoC server spinning up shareable HTML/JS exploit pages with custom response headers baked into the URL; latest push adds nested autocomplete in SVG/XML. Handy harness for header-gated XSS proofs when a program demands a working demo.