[ <- back-issue archive · live wire · issue #21 · HUB 7D · 2026-11-14 22:17 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #21   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/21.intel :: [ 2026-11-14 22:17 UTC ]
  • CVE-2026-119618 mod_http2 race -- Apache shipped a critical race in mod_http2 on Nov 11; Praetorian walks what's actually known versus what vendors are whispering about RCE reachability. Wordfence is already telling WordPress owners to 'confirm their host applied the fix' -- meaning half the shared-hosting world is flying blind [Praetorian].
  • CVE-2026-118383 MongoDB UAF -- use-after-free in the primary catch-up process that an *unauthenticated* client can set up. Datadog reproduced it end-to-end and gives detection angles; unauth + replication internals is the worst possible pairing [Datadog Security Labs].
  • CVE-2026-128240 GPAC gf_sg_proto_del UAF -- MP4Box through 26.07.0 frees prototype scene-graph nodes during XMT teardown then keeps using them (CWE-416, AV:L/UI:R, crash-only per the advisory). Fixed in a2e5c62c; classic media-fuzzing fodder, and 'crash-only' advisories have a way of growing teeth later [oss-security].
  • Blind trust: CSP as credential exfil pipe -- @albinowax shows an allowlisted domain hosting JSONP, uploads, or open redirects turns your CSP right back into a token-theft channel. Vendors pitch CSP as a seatbelt; on most prod targets it's a pre-approved exfil list [James Kettle / PortSwigger].
  • Proofpoint ITM root via crafted filename -- standard Mac user -> root by dropping a file with a crafted name into a OneDrive-managed folder; the File Activity Monitor builds shell commands from filenames without quoting. Endpoint 'security' agents building shell strings from user-controlled names, again [Bishop Fox].
  • Cursor breach -> malicious Claude Code extension -- stolen Fireworks AI credentials let attackers push a poisoned extension through Cursor's marketplace. Full supply-chain hijack of the editor pipeline; audit what your IDE auto-fetches before it audits you [BleepingComputer].
  • CVE-2015-10149 Dancer session ids -- Dancer <1.3400 for Perl hands the session cookie's id straight to the session engine with zero validation, so a crafted cookie pokes directly at whatever backing store (YAML, DBI) sits behind it. Decade-old bug class, fresh eleven-digit number [oss-security].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #21   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/21.possibilities :: [ 230 sources ]
  • Fuzz sibling HTTP/2 teardown paths for the mod_http2 twin -- grab the Apache fix commit, diff the stream-activation and worker-pool teardown ordering against nghttp2 and h2o's connection handling, and hammer interleaved RST_STREAM/GOAWAY under thread contention to see who else shares the race [inspired by Praetorian].
  • Hunt pre-CVE silent patches with videt -- point the negative-day detector at high-value targets (gVisor, MongoDB, Apache) and race the advisory window; the gVisor device-cgroup + filestore-cleanup pushes (heads e45d53c7, ab5f509c) landed with no bulletin, which is exactly the signal class this tool exists for [inspired by vitorfhc/videt].
  • Chain CSPBypass gadget corpus against Kettle's blind-trust flow -- take renniepak/CSPBypass's matcher (freshly fixed for scheme-relative and multi-directive policies), enumerate allowlisted hosts serving JSONP/uploads/redirects on your bounty targets, and wire the credential-relay chain end to end [inspired by PortSwigger + renniepak/CSPBypass].
  • Sweep Perl session engines for the Dancer id-injection class -- diff Dancer 1.3400's validation fix, then grep Dancer2, Mojolicious, and Catalyst session backends for the same unvalidated cookie-id -> engine passthrough; YAML-backed stores are the juiciest (id-as-filename means path traversal) [inspired by oss-security].
  • Mine dawgyg/AppleResearch for portable macOS primitives -- raw C dump of unreported macOS findings that missed bounty thresholds; triage the IOKit/XNU-adjacent ones for portability to iOS and visionOS siblings, since Apple rarely fixes what nobody filed [inspired by dawgyg].
  • Replay the GPAC XMT teardown UAF with heap grooming -- the advisory says crash-only, but gf_sg_proto_del frees prototype nodes mid-parse; build an XMT corpus that interleaves prototype instantiation with parse errors and see if the freed node lands adjacent to attacker-controlled scene data [inspired by oss-security].
  • Audit extension marketplaces for the Cursor credential path -- map which marketplaces (VS Code, JetBrains, Cursor) trust publisher tokens from third-party inference providers, then test whether a rotated-but-stale token still signs a publish -- that's the exact seam the Fireworks AI theft abused [inspired by BleepingComputer].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #21   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/21.github :: [ code & repo tradecraft ]

Quiet on the blogs for stretches, loud in the diffs. Two threads ran through the push stream: @xssdoctor shipping a seven-repo inert battery against Muse's package-install and import lifecycle (marker-file oracles, zero network, zero subprocess -- exactly how you prove an installer executes transitive code without shipping anything malicious), and @dawgyg dumping a raw C corpus of unreported macOS findings straight to git. Meanwhile vitorfhc kept sharpening a negative-day hunter and gVisor bolted device-cgroup confinement on with no bulletin. No conferenceware, no hype -- clean harnesses and suspect patch diffs worth pulling tonight.

  • xssdoctor/git-cve-2026-113408-poc -- loopback protocol-v2 smart-HTTP harness proving git clients swallow an unsafe unborn HEAD symref (symref -> path escape outside .git). Clean, inert oracle you can run locally in five minutes.
  • vitorfhc/videt -- watches major OSS repos for silent security patches landing before CVE assignment, then checks whether the fix is actually reachable. A direct pipeline into the pre-advisory window; point it at the gVisor pushes from this same stretch.
  • dawgyg/AppleResearch -- raw C dump of macOS vuln research the author never reported because it missed bounty thresholds. 510 stars in days; a free corpus of unpatched-looking primitives, some portable to other Apple OSes.
  • renniepak/CSPBypass -- matcher now handles scheme-relative URLs and multiple directives; pair it with Kettle's blind-trust research and your CSP allowlist becomes a gadget-shopping catalog.
  • google/gvisor -- device-cgroup confinement plus a missing filestore cleanup fix (heads e45d53c7, ab5f509c), then proc-umount process-handle and file-lock wait registration work. Descriptor-lifecycle patches with no bulletin -- worth a 10-minute diff.