[ <- back-issue archive · live wire · issue #30 · HUB 24H · 2026-11-15 01:47 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #30   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/30.intel :: [ 2026-11-15 01:47 UTC ]
  • libdca bitstream_fill_current() heap walk -- the unmaintained VideoLAN DTS decoder does tmp = *(state->buffer_start++) in bitstream.c with zero end-of-buffer check, so a malformed .dts frame marches the pointer straight off the heap. Second OOB read in the same library this week; VLC 4.0 already dropped it but distros still ship the lib, so every media front-end that links it inherits the bug [oss-security / SecLists].
  • libdca scale-factor OOB read -- the first of the pair: crafted DTS frame -> scale-factor parsing -> out-of-bounds read in an abandoned decoder with no upstream maintainer to 'fix' anything. Classic negative-day surface: the code is dead, the packages are alive [oss-security / SecLists].
  • Cursor breach -> malicious Claude Code extension -- stolen Fireworks AI credentials let attackers push a poisoned extension through Cursor's marketplace, meaning the editor's own auto-fetch pipeline became the delivery mechanism. Audit what your IDE silently pulls and pin your extension sources; 'marketplace trust' is doing a lot of load-bearing work here [BleepingComputer].
  • DPRK 'FaceStealer' disruption -- US takedown hit infrastructure behind $400M+ in spoofed-identity crypto theft. Expect retooling and fresh lures, not a stop; the social-engineering playbook survives its hosting [BleepingComputer].
  • Patch-to-exploit automation pointer -- Miessler flags Dawn Song's team going from patch diff to working exploit. No code drop in the excerpt, but the direction is clear: the window between commit and advisory keeps shrinking [Daniel Miessler / @DanielMiessler].
  • gVisor sandbox tightening -- proc-umount process-handle work, host-net child netns loopback handling, and file-lock wait registration all landed in one push. Sandbox maintainers bolting locks on quietly usually means somebody was rattling the door [google/gvisor].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #30   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/30.possibilities :: [ 75 sources ]
  • Fuzz every distro-shipped consumer of libdca -- grab the exact bitstream.c and scale-factor parsing diffs from the oss-security threads, build a DTS frame mutator around the bitstream reader, and hammer ffmpeg/ffmpeg-derived front-ends and any distro package still linking libdca for the same unchecked buffer_start++ walk [inspired by oss-security].
  • Hunt the negative-day window with videt -- point vitorfhc/videt at high-value OSS repos (media parsers, sandbox kernels, VPN daemons) and race the commit-to-CVE gap; libdca proves silent fixes in abandoned code can sit unadvisored for ages [inspired by vitorfhc/videt].
  • Chain header-gated XSS via responder -- use JorianWoltjer's query-param PoC server to bake arbitrary response headers into a shareable URL, then probe CSP/COOP/header-allowlist bypasses on bug-bounty targets that gate content on response headers [inspired by JorianWoltjer/responder].
  • Diff gVisor's proc-umount and netns loopback merges -- pull the exact commits, grep for sibling process-handle and child-netns paths that did NOT get the same treatment, and hammer teardown ordering under the new file-lock wait registration [inspired by google/gvisor].
  • Audit editor extension supply chains -- the Cursor/Fireworks credential theft shows marketplace push paths are one stolen token away from code execution on dev machines; map which marketplaces sign vs merely authenticate packages, and test whether revoked upstream creds actually kill published extensions [inspired by BleepingComputer].
  • Automate your own patch-to-exploit loop -- mirror the Dawn Song team's approach on fresh n-day diffs: pull the patch, isolate the changed invariant, and build the minimal primitive before the advisory drops and everyone piles in [inspired by Daniel Miessler].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #30   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/30.github :: [ code & repo tradecraft ]

Thin night on the blogs, so the git stream did the talking. The pattern worth watching: tooling that weaponizes the gap between a silent fix and a public advisory, sandbox maintainers quietly tightening handle and namespace behavior, and a couple of Bun-built static preview repos whose pinned runtime deps are exactly the kind of supply-chain seam yesterday's Cursor breach proved attackers will ride. No conferenceware, no hype -- just diffs and harnesses worth pulling before the CVEs land.

  • vitorfhc/videt -- Python watcher that flags silent security patches landing in major OSS repos before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Built for the negative-day window; point it at your favorite parser repo tonight.
  • JorianWoltjer/responder -- query-param PoC server that renders shareable HTML/JS exploit pages with custom response headers baked into the URL; latest push adds nested autocomplete in SVG/XML. Handy oracle for header-gated XSS proofs.
  • google/gvisor -- proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration merged in one push. Textbook sandbox hardening; diff it for the unpatched sibling paths.
  • xssdoctor/muse-grid-card-preview-20261114 -- static grid card preview fixture where bun install pulls a pinned runtime dep (muse-grid-card-runtime-20261114) before writing dist/index.html. Inert on its own, but the pinned-dependency import chain is a supply-chain seam worth diffing.
  • google/osv.dev -- least-privilege service account lockdown on Cloud Run, RPM version-ordering fixes for TuxCare/CentOS/OracleLinux/RHEL, and goose pooled-SQL repair. Version-comparison fixes in a vuln DB are the kind of quiet correctness change that changes triage output.