[ <- back-issue archive · live wire · issue #24 · HUB 24H · 2026-11-14 23:03 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #24   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/24.intel :: [ 2026-11-14 23:03 UTC ]
  • CVE-2015-10149 -- Dancer session ids go straight to the engine -- Dancer <1.3400 for Perl passes the session cookie's id into the session backend with zero validation, so a crafted cookie pokes whatever store backs it (YAML, DBI, Redis handlers all eat the raw string). Classic injection-by-cookie; filter the id or jump past 1.3400 [oss-security].
  • CVE-2026-128240 -- GPAC/MP4Box use-after-free in gf_sg_proto_del -- XMT scene teardown frees proto state and then walks it again (CWE-416, CVSS 5.5, AV:L/UI:R, crash-only per the advisory). Fixed in a2e5c62c; crash-only today, but scene-graph teardown bugs have a habit of growing teeth once someone controls the free order [oss-security].
  • Cursor breach -> malicious Claude Code extension -- attackers lifted credentials from Fireworks AI and pushed a poisoned Claude Code extension through Cursor's marketplace, hijacking the editor supply chain end to end. Audit what your editor auto-fetches and pin your extension sources before the next round lands [BleepingComputer].
  • DPRK 'FaceStealer' disruption -- expect retooling, not retirement -- US action hit infrastructure behind $400M+ in spoofed-identity crypto theft. Crews this patient don't stop; they re-register domains and refresh lures within weeks [BleepingComputer].
  • gVisor quietly tightens sandbox state -- new merges bolt on proc-umount process-handle work, host-net child netns loopback handling, and file-lock wait registration. Sandbox maintainers patching handle lifetime without a bulletin usually means somebody was holding descriptors across teardown [google/gvisor].
  • osv.dev hardens its own plumbing -- Cloud Run pinned to a least-privilege service account, RPM version ordering fixed for TuxCare/CentOS/OracleLinux/RHEL, and goose pooled-SQL handling repaired. Version-comparison bugs in a vuln DB are their own class of blind spot [google/osv.dev].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #24   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/24.possibilities :: [ 67 sources ]
  • Hunt Dancer session-engine injection across sibling frameworks -- grab the 1.3400 diff, see exactly which validation landed, then grep Dancer2, Mojolicious, and Catalyst session plugins for the same raw-cookie-id-to-backend pattern; YAML and DBI backends are the juiciest sinks [inspired by oss-security].
  • Fuzz GPAC XMT teardown for a controllable free -- build a corpus of XMT/BT scene files, target gf_sg_proto_del with a use-after-free sanitizer harness, and try to control proto-deletion order via nested proto instantiation; if you can interleave frees, 'crash-only' stops being true [inspired by oss-security].
  • Audit extension-marketplace trust chains -- Cursor's pipeline trusted upstream credentials from Fireworks AI; map every marketplace that auto-fetches packages on editor open (VS Code, JetBrains, Cursor forks) and check for signing, publisher verification, or the lack of it [inspired by BleepingComputer].
  • Diff gVisor's proc-umount and netns loopback merges -- pull 5f7e73a9, trace which process handles survive umount and how host-net child netns loopback is wired; a handle that outlives its namespace is a sandbox-escape seed [inspired by google/gvisor].
  • Probe osv.dev RPM version-ordering edges -- the fix covers TuxCare/CentOS/OracleLinux/RHEL; feed the comparator epoch/release-suffix corner cases (el8 vs el8_4, ~pre, ^dist tags) and see if any distro still sorts wrong, which silently hides matching advisories [inspired by google/osv.dev].
  • Chain responder's header-gated XSS pages against CSP allowlists -- the new nested autocomplete in SVG/XML plus custom response headers makes it a clean oracle for testing header-gated XSS and JSONP-style exfil against real targets' CSP rules [inspired by JorianWoltjer/responder].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #24   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/24.github :: [ code & repo tradecraft ]

Thin news night, so the wire desk spent it watching what actually got pushed. Two threads stood out: sandbox and vuln-DB maintainers quietly locking down handle lifetime and service-account scope with no fanfare, and the small-tool researchers shipping harnesses for header-gated XSS proofs and negative-day patch detection. Nothing flashy -- just diffs worth pulling and a supply-chain seam that smells like a demo of what bun install executes without asking.

  • vitorfhc/videt -- Python watcher that flags silent security patches landing in major OSS repos before a CVE gets assigned, then checks whether the fix is actually reachable/exploitable. Negative-day window between commit and advisory is where the real hunting lives; this automates the diff-trawling grind.
  • JorianWoltjer/responder -- shareable HTML/JS exploit pages with custom response headers baked into the URL, built for header-gated XSS proof; latest commits add nested autocomplete in SVG/XML plus a small-screen scrolling fix. Tight little oracle for CSP and header-logic testing.
  • xssdoctor/muse-grid-card-preview-20261114 -- static grid card preview fixture where bun install pulls a pinned runtime dep (muse-grid-card-runtime-20261114) and the build imports card copy from it before writing dist/index.html. Zero payload, but it's a clean demonstration of how much code a bun install && bun run build executes from an unpinned-by-default supply chain. Worth a 10-minute diff.
  • google/gvisor -- proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration all landed in one push window. Sandbox state getting locks bolted on is always a signal; diff the teardown paths.
  • danielmiessler/SecLists -- automated Trickest wordlist refresh via GitHub Actions; nothing new conceptually, but the fresh fuzzing payloads and patterns land before most assessment boxes sync them. Update your local mirror.