Free, Then Walk: Teardown Bugs, Ghost Publishers, and the Handles Nobody Closed

Three criticals in four weeks and every one of them is the same shape: an object gets freed on one path while another path still holds the pointer. MongoDB's CVE-2026-118383 is the loudest -- a use-after-free in the primary catch-up process that unauthenticated clients set up themselves with a crafted replication handshake. No creds, no auth wall, just a freed object waiting to be walked, and Datadog already shipped the full repro. Apache's CVE-2026-119618 is the identical fault line wearing a protocol hat: a race in mod_http2 connection/stream teardown, disclosed November 11, where stream state gets freed while a sibling thread is still reading it. Race windows in teardown are the classic UAF factory, and this one sits on every frontend that terminates h2. GPAC closes the set -- CVE-2026-128240, gf_sg_proto_del freeing prototype scene-graph nodes during XMT scene teardown in MP4Box through 26.07.0 and then using them, fixed in a2e5c62c, stamped CVSS 5.5 AV:L/UI:R 'crash-only'. Three codebases, three languages, one invariant nobody wrote down: who owns the pointer after the free.

The negative-day supply is worse than the criticals, because nobody is coming to fix it. libdca -- VideoLAN's unmaintained DTS decoder -- coughed up two out-of-bounds reads this month: tmp = *(state->buffer_start++) in bitstream.c with zero end-of-buffer check, so a malformed .dts frame marches the read pointer straight off the heap, plus a second one in scale-factor parsing oss-security. VLC 4.0 dropped the library; distros still ship it, so every ffmpeg/gstreamer front-end, car head unit, and set-top parser that links it inherits both bugs. Then there's dawgyg/AppleResearch -- a 510-star raw C dump of macOS findings the author never reported because they fell under bounty thresholds, believed unpatched and portable to adjacent Apple platforms. Free seed material for anyone willing to compile it. Same 'we bounded it after the fact' smell over at SoapyRemote 0.5.4, which just added bounds on stream header bytes/elems in acquireRecv plus mid-payload peer-close handling -- maintainer-speak for 'someone crashed the RPC path.' Fire truncated and oversized stream headers at a hostile-client-shaped server and see what the new checks actually catch.

The supply-chain thread is shorter and nastier: stolen Fireworks credentials were enough to push a poisoned extension through Cursor's marketplace and into developer editors BleepingComputer. No zero-day, no exotic primitive -- a third-party token signed a marketplace upload and the editor's own auto-fetch pipeline handled delivery. The questions worth asking tonight are boring and damning: does your marketplace verify publisher identity per-publish or per-session, and does revoking the upstream credential actually kill the publish path, or just the login? Same failure mode in a kernel hat over at google/gvisor, where e45d53c7, ab5f509c, and 5f7e73a9 quietly bolted the sandbox into a device cgroup, plugged a missing filestore cleanup path, and added proc-umount process-handle work. Sandbox maintainers don't touch descriptor cleanup without a bulletin unless somebody worked out how to hold a handle across container teardown. Grep Kata and Firecracker for the unpatched twin.

Identity keeps failing in the orthogonal direction: the gate holds, the inventory leaks. Bishop Fox's Cirro work shows a guest account under the most restrictive Entra ID settings still reads application properties -- redirect URIs, service principal names -- by traversing known app IDs, with Cirro v1.4.0 automating the walk. 'Restricted' guest is doing a lot of load-bearing work in that sentence, and the natural chain is known app ID -> redirect-URI abuse -> consent phishing -> token theft. On the wire, the tooling got sharper at the layers people skip: ProtoSpector decodes and re-encodes protobuf and gRPC on the fly inside Burp so you can mutate fields in binary HTTP bodies instead of guessing byte offsets, and h3fuzz throws 100k req/s over QUIC at HTTP/3-only origins where the classic stack throttles out. Pair them and the protobuf endpoint that only speaks h3 stops being a black box.

The RF desk ran its own version of the same story: reference signals nobody verifies. Ukraine's Lima system layers spoofing on top of wideband jamming so drones and guided weapons -- Oreshnik included -- resolve to coordinates in Peru, and Russian kit still leans hard on GNSS despite Chayka/eLoran fallbacks. It works because the receiver has no integrity check, which is exactly what the Turk Telecom/Calnex holdover data shows from the other side: kill the antenna at a base station and holdover runs out with no re-sync grace, sync degrading silently until backhaul errors surface. Two open benches turn that from anecdote into a number. osqzss/pluto-crpa computes adaptive weights on the PS, combines them in the PL, and re-transmits at GPS L1 (1575.42 MHz) into a COTS receiver -- real two-element null steering on AD9363 + Zynq-7010. And krakenrf/krakensdr_suite ripped out its Python layer entirely so real-time spectrum, audio demod, and MUSIC DoA estimation run concurrently on a Pi 5, with a Mode selector carving up tuner allocation.

The bench hardware matters because it changes who can run these tests at all. PortaPack Mayhem extended PRALINE TX/RX clock sync to the HackRF Pro's internal 25 MHz TCXO and killed SD write corruption by switching to single-beat SDIO IDMAC transfers -- clock-honest enough that the displayed frequency is worth trusting. ESP32DualBandWardriver promoted 6 GHz to main with Wardacted log sanitization (hashed MACs in exports), so sub-$20 tri-band wardriving is a mainline build, and hcxtools stopped counting zeroed PMKs as corrected, which matters when you're sorting crackable EAPOL captures from noise. And vanhoefm/papers already has the Wisec 2026 and SecDev 2026 decks at 3ea9f01f -- read the mechanics and pre-build the monitor-mode plus injection harness on mt76 or rtw89 before the papers go wide. So: pull the Mongo catch-up patch and grep rollback, resync, and oplog-fetch for the same free-then-walk; script interleaved RST/HEADERS/window-update against a pre-patch httpd and diff the fix for the exact lock ordering; run a heap groomer against GPAC's 'crash-only' XMT teardown before you believe CVSS 5.5; build .dts corpora around the libdca bitstream reader and check whether the walk leaks heap bytes instead of just segfaulting. The patch diff is the exploit -- you just have to read it first.