Hold the Handle Open: Teardown Races, Dead Decoders, and Trust Boundaries That Never Were

MongoDB's primary catch-up process and Apache's mod_http2 share this week's ugliest bug class: an unauthenticated stranger gets to drive the clock on a free-then-use window. CVE-2026-118383 is a critical use-after-free in the catch-up process that unauthenticated clients set up themselves, and Datadog reproduced it end to end -- meaning the free-then-use window in catch-up state handling is real, reachable, and waiting for someone to force primary transitions mid-sync on a lab cluster until it swings open. CVE-2026-119618 is a race-to-RCE in mod_http2, the listener-side module every HTTP/2 front door runs, disclosed Nov 11; the first question on any target is whether the reverse proxy in front terminates h2 or passes it through, because that decides whether the race is reachable at all. Meanwhile Google quietly bolted gVisor into a device cgroup and patched a missing filestore cleanup path in the same push (heads e45d53c7, ab5f509c), alongside proc-umount process-handle work, host-net child netns loopback handling, and file-lock wait registration -- no bulletin, no fanfare [worth diffing]. When a sandbox maintainer plugs a descriptor leak without a word, assume somebody already worked out how to hold that handle open across container teardown. Cleanup paths are where the locks aren't.

The negative-day story of the week is a dead decoder. libdca -- the abandoned VideoLAN DTS parser -- executes tmp = *(state->buffer_start++) in bitstream.c with zero end-of-buffer check, so a malformed .dts frame marches the pointer straight off the heap inside bitstream_fill_current(); it is the second OOB read in that library this week after the scale-factor parsing bug, and the punchline is that VLC 4.0 already ripped the lib out while distros keep shipping it. Dead code, live packages. Every media front-end linking it inherits the bug, and there is no upstream maintainer left to 'fix' anything. This is exactly the surface commit-racing tools like vitorfhc's videt are built for, and the Dawn Song crew going patch-diff -> working exploit says the commit-to-advisory window is collapsing from both ends at once. Your move: pull the exact bitstream.c and scale-factor diffs off the oss-security thread, build a DTS frame mutator around the bitstream reader, and hammer ffmpeg's DTS parser and the libdcadec forks for the same unchecked walk. Ten-year-old parse paths, zero eyes, full distro reach.

One layer up, every trust boundary leaked in the same direction. Stolen Fireworks credentials let attackers push a malicious extension through Cursor's marketplace, turning the editor's own auto-fetch pipeline into the delivery mechanism -- one publish token away from code execution on every dev box that trusts the store, and nobody has audited whether revoked upstream credentials actually kill an already-published package. Microsoft's 'most restrictive' Entra ID guest settings block directory listing but still leak application properties when you traverse known app IDs, and Cirro v1.4.0 automates the walk -- feed it app IDs harvested from OAuth redirect URIs and public client configs, then map which tenants hand you a clean enumeration oracle. ProtoSpector rips the 'nobody can read this' armor off any gRPC endpoint by decoding and re-encoding protobuf on the fly inside Burp, which matters because most server-side validation was written assuming nobody could edit the wire format. The wetware runs the identical con: the Macfinger campaign's DownTheDRAIN clickjacks a fake 'verify you are human' page into paste-and-run Terminal one-liners, because clipboard -> shell is still the cheapest initial access on macOS. Four different layers, one fault line: trust outsourced to context -- a marketplace token, a guest setting, a binary schema, a clipboard -- and never re-verified at the point of use.

The RF side of the wire runs the identical fault line at the physical layer. Ukraine's Lima layer stacks false position fixes on top of wideband jamming until GNSS-dependent drones and guided weapons (Oreshnik included) resolve to the wrong hemisphere -- receivers trust time-of-arrival without sanity-checking ephemeris, and Russian kit keeps leaning on GNSS even with Chayka and eLoran sitting right there. The Turk Telekom/Calnex ITSF 2026 measurements show the other half: when GNSS drops at a base station there is no re-sync grace, holdover runs out, and timing degrades silently until the RAN eats itself -- which is exactly why spoofing a single reference receiver is so cheap. The dependency is the attack surface. The bench gear to measure it landed in the same window: pluto-crpa from the GPS-SDR-SIM author puts a two-element CRPA on an AD9363 + Zynq-7010, adaptive weights computed on the PS, combined in the PL, re-transmitted at GPS L1 into a COTS receiver @osqzss]; [KrakenSDR V2 ripped out its Python layer so real-time spectrum and audio demod run concurrent with MUSIC DoA estimation on a Pi 5; Mayhem extended PRALINE TX/RX clock sync to the HackRF Pro's internal 25 MHz TCXO and killed SD corruption with single-beat SDIO IDMAC transfers; and the ESP32-C5 wardriver now walks the 6 GHz band for under $20 with hashed MACs in its exported logs. Strip the RF vocabulary and it is paragraph one again: an unauthenticated broadcast driving a trust decision nobody re-verifies.

So here is what we would run this week, in payout order. Rebuild the mod_http2 race window with concurrent RST_STREAM, GOAWAY, and window-exhaustion patterns against unpatched Apache front doors, and check whether your targets' hosts actually applied the fix or are just 'aware of it' -- reachability is the whole game on a listener-side race. Diff the patched MongoDB server, pin the exact free-then-use window in catch-up state handling, and force primary transitions mid-sync on lab clusters. Pull gVisor heads e45d53c7 and ab5f509c, trace which filestore path missed cleanup, and try holding descriptors across sandbox teardown on the pre-patch build -- if the escape primitive worked last month, older nodes are still naked. Fire truncated and oversized stream headers at any SoapyRemote 0.5.x daemon still running, because 0.5.4's acquireRecv bounds and mid-payload peer-close handling are maintainer-speak for 'someone could crash or worse the RPC path'. Then hit the bench: feed pluto-crpa a swept CW and a chirp jammer at 1575.42 MHz, log the C/N0 delta on the COTS receiver before and after weight adaptation, and yank the antenna on a GPSDO-equipped receiver to chart how long holdover actually holds on cheap TCXO versus OCXO -- most 'GNSS-backed' timing gear has no honest holdover spec.

The lesson holding the whole week together: the signal lives in the diffs, not the bulletins. gVisor bolting locks on without a word, libdca rotting unadvisored in distro packages, a marketplace that authenticated but never signed, guest settings that restrict listing but not reading -- every one of those was visible in a commit log or a config default long before anyone wrote a blog. The DPRK FaceStealer crew will retool inside a month; the social-engineering playbook survives its hosting. And vanhoefm just dropped Wisec 2026, PAKE 2026, and SecDev 2026 decks at papers 3ea9f01f -- pull them now and pre-build the monitor-mode and frame-injection harness (mt76 out-of-tree on MT792x, 6 GHz channels) before the mechanics go mainstream. Race the quiet commits. The window between a maintainer knowing and everyone knowing is the only window that pays.