The Teardown Is the Bug: Handles, Cookies, Credentials, and Almanacs All Outlive Their Owner

The free lands before the walk. GPAC's MP4Box through 26.07.0 frees prototype scene-graph nodes in gf_sg_proto_del during XMT scene teardown and then keeps walking them -- CWE-416, CVSS 5.5, AV:L/UI:R, 'crash-only' if you buy the label -- closed in a2e5c62c. Same week, CVE-2026-118383 hands an unauthenticated client a use-after-free in MongoDB's primary catch-up process, reproduced end to end by Datadog on attacker-controlled timing against replication state. And CVE-2026-119618 is a plain race in Apache's mod_http2 stream and connection teardown, disclosed Nov 11 with RCE chatter trailing behind it. Three products, three memory models, one fault line: nothing owns the object after the state machine that was supposed to reap it has moved on. The scoring keeps calling these crashes. The mechanics keep saying otherwise.

Look at who quietly re-keyed the locks. gVisor merged e45d53c7, ab5f509c, and 5f7e73a9 -- device-cgroup confinement, a missing filestore cleanup path, proc-umount process-handle work, host-net child netns loopback, file-lock wait registration -- with no bulletin and no CVE. That silence is the tell: patching descriptor lifetime across teardown without a press release usually means somebody worked out how to hold the handle past the namespace. Same shape elsewhere. rtl_433 shrank MAXIMAL_BUF_LENGTH, reopened the SDR cleanly, and silenced connection handlers before mg_mgr_free(); SoapyRemote 0.5.4 bounded stream header bytes and elems in acquireRecv and now fails the RPC on mid-payload peer close; go-cloud closed a gcsblob reader that leaked on the BeforeRead error path, with s3blob and azureblob as the obvious unpatched siblings. A handle that outlives its namespace is host context on layaway. A reader that never closes on the error return is the same bug wearing a cloud SDK.

The trust boundary moved up a floor and nobody re-keyed that door either. Cursor's marketplace took stolen Fireworks AI credentials, published a malicious Claude Code extension, and let the editor auto-fetch it -- registry trust semantics bolted onto a pipeline with no registry-grade signing, publisher re-verification, or immutability after publish. The mirror image is inert: xssdoctor's muse-dependency-lifecycle-parent-20261114 ships a parent with zero pre/install/postinstall hooks that pins a researcher-owned dep at a fixed commit, and the leaf's postinstall writes a marker file inside its own directory -- no network, no subprocess, no symlink. Run it and you learn whether your resolver still executes transitive lifecycle scripts. Textbook harness. Meanwhile osv.dev fixed RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL and pinned Cloud Run to a least-privilege service account; a comparator bug in a vuln DB is a silent severity downgrade for a whole distro family, and every downstream triage consumer eats it. CAGE's signed tamper-evident receipts are worth exactly the policy input -- race the check-to-actuation window and the receipt documents your bypass in triplicate.

Every one of these is the same sin at a different layer: a defense that accepts a string and trusts it. Dancer below 1.3400 (CVE-2015-10149) hands the session cookie's id to the session backend with zero validation -- YAML, DBI, and Redis handlers all swallow the raw value, so path-shaped and format-shaped ids land straight in the engine. Eleven digits of CVE on a bug class older than half the people reading this. Proofpoint ITM 4.4.3.148 / 5.0.1 is the same failure with a shell in the middle: a standard macOS user drops a file with a crafted name into a OneDrive-managed folder, the File Activity Monitor builds a command from that filename without quoting, and you are root in a synced directory. Quote your argv; better, stop building shell strings at all. CSP allowlists collapse identically per @albinowax -- one allowlisted host serving JSONP, uploads, or an open redirect turns blocked XSS back into token theft, which makes the policy a 'pre-approved exfil list' with your own origins on it. Map it with renniepak/CSPBypass, then point JorianWoltjer/responder at the result to see which header-gated paths still fire. Compiler-level cousins count too: j2cl just fixed redundant-cast removal for intersection and null-literal casts, and miscompiles are quiet type-confusion factories.

The RF bench is running the identical argument on physics instead of memory. osqzss/pluto-crpa builds a two-element controlled-reception-pattern array on a PlutoSDR -- AD9363 plus Zynq-7010, adaptive weights computed on the PS, combined in the PL, re-transmitted at GPS L1 into a COTS receiver -- an open nulling rig you can aim at your own jammer for the price of a dev board. krakenrf/krakensdr_suite dropped Python outright: five coherent channels, MUSIC DoA running concurrently with real-time spectrum and audio demod on a Pi 4/5, Mode selector for tuner allocation. Bench-grade passive radar in a shoebox. Against that, Ukraine's Lima reportedly relocates receivers to Peru wholesale, and Turk Telekom with Calnex walked ITSF 2026 through a national carrier's sync plane folding when GNSS is the only holdover -- L1 jamming cascading into backhaul PTP. Mass meaconing beats per-platform hardening every time. The timing tools are arriving to match: LimeSDR Micro VSPA now schedules stream start at a specific sample index with Hann-windowed Rx DFT bins, PRALINE locks TX/RX to the HackRF Pro's internal 25 MHz TCXO so replay bursts stay on-frequency across long captures, and the ESP32-C5 wardriver promoted 6 GHz to main with Wardacted hashed-MAC sanitization on export. Vanhoef's fresh decks at 3ea9f01f are the reading list before the PDFs circulate.

Pull the Apache fix first -- map the exact stream/teardown interleaving it guards, then diff nghttp2, Envoy's h2 codec, and Go's net/http2 for the unpatched cousin, because race fixes in one h2 stack are never alone. Script unauthenticated connections against an unpatched replica-set primary and measure how wide the MongoDB window actually is before you accept 'timing-dependent'. Heap-groom gf_sg_proto_del with interleaved proto instantiation and see if 'crash-only' survives controlled frees, then check libgpac's BIFS and VRML paths for the same teardown shape. Grep every endpoint agent you can get your hands on for subprocess calls assembled from filenames. Audit which marketplaces sign packages and which merely gate on publisher auth. Point vitorfhc/videt at GPAC, ImageMagick, and curl and race the negative-day gap between fix commit and advisory. Whoever owns the lifetime owns the bug -- this week it just happened to be nobody at all.