.-. .-. (: `--------------------' :) ) intel brief // #22 ( (: .--------------------. :) `-' `-'
- Barracuda ESG pre-auth remote root -- watchTowr chains CVE-2026-116606 and CVE-2026-111560 into pre-auth remote root on the Email Security Gateway. Full writeup with the chain mechanics, so every unpatched appliance on the internet is now a countdown timer [watchTowr Labs].
- CVE-2026-119618 mod_http2 race -- critical race condition in Apache's HTTP/2 module, disclosed Nov 11, with RCE potential per the follow-on PSA. Race bugs in stream handling are exactly where desync-to-heap primitives get born; diff the fix commit before someone else does [Praetorian].
- CVE-2026-118383 MongoDB UAF -- unauthenticated clients can set up the primary catch-up process that then trips a use-after-free in MongoDB Server. Full reproduction writeup, which means the exploit path is documented end to end [Datadog Security Labs].
- CSP allowlists as credential exfil pipes -- @albinowax shows an allowlisted host serving JSONP, uploads, or open redirects turns blocked XSS right back into token theft. Vendors still pitch CSP like a magic seatbelt; on most prod targets it's a pre-approved exfil list [James Kettle].
- CVE-2026-128240 GPAC use-after-free -- MP4Box through 26.07.0 frees prototype scene-graph nodes in gf_sg_proto_del during XMT scene teardown and keeps using them (CWE-416, crash-only per the advisory, fixed in a2e5c62c). 'Crash-only' advisories on media parsers have a long history of graduating to code execution [oss-security].
- Cursor marketplace supply-chain hijack -- stolen Fireworks AI credentials let attackers push a malicious Claude Code extension through Cursor's marketplace. Audit what your editor auto-fetches tonight, not next quarter [BleepingComputer].
- Proofpoint ITM root via crafted filename -- a standard Mac user gets root by dropping a file with a crafted name in a OneDrive-managed folder, because the File Activity Monitor builds shell commands from filenames. Classic quoting bug, textbook impact [Bishop Fox].
.-. .-. (: `----------------------' :) ) possibilities // #22 ( (: .----------------------. :) `-' `-'
- Diff the mod_http2 fix for sibling stream races -- pull the Apache httpd fix commit, map which stream-state transitions lost their lock, then grep mod_proxy_http2 and h2 workers for the same unlocked teardown order under concurrent RST_STREAM. Race fixes rarely land alone [inspired by Praetorian].
- Hunt GPAC's scene-graph teardown twins -- gf_sg_proto_del frees prototype nodes during XMT teardown; fuzz the same teardown path via BT and SVG scene imports, and check whether the LASeR codec path shares the node-lifetime bug. Fixed in a2e5c62c -- diff it against every other gf_sg_*_del caller [inspired by oss-security].
- Turn CSP allowlists into your exfil menu -- enumerate script-src hosts on your target, fingerprint each for JSONP callbacks, upload endpoints, and open redirects, then chain any gadget into credential theft. Pair with renniepak/CSPBypass for the matcher work [inspired by James Kettle].
- Replay the MongoDB catch-up UAF against replica sets -- the unauthenticated setup path into the primary catch-up process is the interesting part; check whether older server branches and mongos routers expose the same initialization race [inspired by Datadog Security Labs].
- Audit editor extension pipelines like Cursor's -- map every marketplace your team auto-fetches from (VS Code, Cursor, JetBrains), check for publisher-verification gaps, and test whether a stolen publisher token is all it takes to push an update. That's the whole chain [inspired by BleepingComputer].
- Sweep macOS endpoint agents for filename-to-shell bugs -- the Proofpoint File Activity Monitor builds shell commands from filenames; grep other DLP/EDR agents for popen/system calls fed by filesystem event names, then drop crafted filenames in cloud-sync folders. Sibling agents almost certainly share the pattern [inspired by Bishop Fox].
- Mine the unreported macOS corpus for portable bugs -- a raw C dump of macOS findings that fell under bounty thresholds; triage the memory-corruption entries, then check whether the same code paths exist in iOS and visionOS frameworks [inspired by dawgyg].
.-. .-. (: `---------------------' :) ) github brief // #22 ( (: .---------------------. :) `-' `-'
Quiet on the vendor blogs for long stretches, which left the git firehose carrying the whole wire. Two threads ran through the diffs: researchers shipping inert marker-file harnesses that prove what package installers and git clients execute behind closed doors, and tooling for catching silent security patches before a CVE number exists. Meanwhile a straight dump of unreported macOS bug research landed with 500+ stars overnight -- the kind of corpus that gets triaged fast or gets patched faster. No hype, just harnesses and diffs worth pulling tonight.
- xssdoctor/git-cve-2026-113408-poc -- companion work in the same muse-* matrix: the loopback protocol-v2 smart-HTTP harness proving git clients swallow an unsafe unborn HEAD symref (symref -> path escape outside .git). Clean, inert oracle you can run locally in five minutes.
- xssdoctor/muse-dependency-lifecycle-parent-20261114 -- parent package ships zero hooks but pins a researcher-owned dep at a fixed commit; the leaf's postinstall writes a marker strictly inside its own dir. No network, no subprocess, no symlink -- textbook oracle for transitive lifecycle-script execution.
- vitorfhc/videt -- 'negative-day' detector watching major OSS repos for silent security patches landing before CVE assignment, then checking whether the fix is actually reachable. A direct pipeline for pre-CVE hunting; point it at the sandbox layer that pushed quietly this month.
- dawgyg/AppleResearch -- raw C dump of macOS vulnerability research the author believes should be patched but went unreported for missing bounty thresholds. Large corpus, some findings likely portable to other Apple OSes; triage before it gets silently fixed.
- renniepak/CSPBypass -- latest push fixes the CSP matcher to handle scheme-relative URLs and multiple directives. Directly complements the Blind Trust research -- feed it your target's policy and get the gadget list back [@renniepak].