Teardown Races, Stolen Push Tokens, and Patches That Whisper

MongoDB, Apache, and GPAC all shipped the same bug this month: an object that outlives the state machine that spawned it. CVE-2026-118383 is a critical use-after-free in MongoDB Server's primary catch-up process, and the nasty part is that unauthenticated clients set up the catch-up condition themselves -- the free-then-use window is attacker-scheduled, not attacker-hoped-for. Datadog reproduced it end to end; on any exposed Mongo port, the catch-up path is the front door. CVE-2026-119618 is the same disease in mod_http2, the module every HTTP/2 front door runs: a critical race disclosed Nov 11 with RCE potential on default installs, while Wordfence tells WordPress owners to 'ask their host' -- classic euphemism for 'you can't fix this yourself' (assuming your host applied the patch and is not merely 'aware of it'). GPAC rounds out the set: XMT scene teardown frees proto nodes, then reuses them, and an advisory billing that as 'crash-only' deserves a re-test with attacker-sized allocations parked next to the freed proto state. Teardown and transition code is where nobody audits, because nobody thinks of shutdown as attack surface. Catch-up, stream-cancel, scene-teardown -- all 'bookkeeping' until somebody wins a race against them.

The quiet commits are the tell. Google bolted gVisor into a device cgroup and patched a missing filestore cleanup path in the same push (heads e45d53c7, ab5f509c) with no bulletin attached -- when a sandbox maintainer plugs a descriptor leak at 2 AM, assume somebody already worked out how to hold that handle open across container teardown, and go try it on pre-patch nodes. Worth a 10-minute diff. The same dialect is everywhere right now: SoapyRemote 0.5.4 grew bounds checks in acquireRecv plus mid-payload peer-close handling, readsb clamped the --filter-DF bitset shift and started framing GNS HULC messages in readBeast(), hcxtools added a confirmed-PMK counter and stopped counting zeroed PMKs as corrected in your EAPOL dumps, and rtl_433 landed a MAXIMAL_BUF_LENGTH shrink plus a clean SDR reopen for ESP-IDF builds. That is maintainer language for 'somebody found truncation bugs.' Point videt-style repo-watch logic at gVisor's filestore commits and MongoDB's catch-up code, verify reachability, and you are hunting negative-day before the advisory drops. Silent fixes land before CVEs get assigned; reading diffs faster than the assigner is now a discipline, not a party trick.

The trust anchors fell in the same month, and none of them were ever load-bearing. Stolen Fireworks credentials let attackers push a malicious Claude Code extension straight through Cursor's marketplace -- credential theft -> marketplace push is a proven chain now, so ask whether VS Code Marketplace, JetBrains, and the OpenVSX mirror validate publisher identity on every push or only on first publish, and whether any client checks artifact provenance at install time. Microsoft's 'most restrictive' Entra ID guest settings block directory listing but still leak application properties when you traverse known app IDs, and Cirro v1.4.0 automates the walk into redirect URIs, weak consent scopes, and owner emails that feed phishing pretexts. CSP allowlists do the same job in reverse: CSPBypass now handles scheme-relative and multiple directives, so any allowlisted host serving JSONP, uploads, or open redirects converts blocked XSS back into token theft. Wire formats are folding too -- ProtoSpector decodes and re-encodes protobuf/gRPC on the fly in Burp, so server-side validation written on the assumption nobody could edit the wire format is exposed as what it always was, and even Meshtastic's protobuf bump to v2.8.2.31 is worth a capture-and-diff at the 869.525 MHz EU slot to see what actually shifted on-air. Meanwhile the cheapest initial access on macOS remains a fake 'verify you are human' page talking a victim into pasting a shell one-liner into Terminal (DownTheDRAIN). Marketplace tokens, guest reads, CSP hosts, protobuf fields, the clipboard -- five 'boundaries' that were only ever suggestions.

The abandoned parse paths keep paying while the bounty economy pretends otherwise. libdca -- the unmaintained VideoLAN DTS decoder -- took its second OOB read this stretch: tmp = *(state->buffer_start++) in bitstream.c with zero end-of-buffer check, so a malformed .dts frame marches the pointer straight off the heap (oss-security). VLC 4.0 already ripped the library out, but distros still ship it, so every media front-end linking it inherits the bug -- and abandoned decoders rarely die alone, which makes ffmpeg's DTS parser, the libdcadec forks, and libavcodec's AC-3/E-AC-3 paths the next harnesses to hammer with truncated and over-long frames. Same economics at Apple: dawgyg dumped a 510-star corpus of macOS findings that never cleared bounty thresholds -- a free bug buffet, and the same IPC and XNU surfaces often pay on iOS and visionOS where the bar is lower, so cross-reference each bug against IOKit user clients and XPC services still present on mobile. Kettle named the gap plainly: programs that once rejected pivoting now demand you break in, grab creds, and chain as deep as possible, while high/crit bugs rot in ignored reports. Triage gap meets impact inflation. The FBI flash alert on Artex -- recon -> exploit -> privileged access in under three hours -- is the other half of the ledger. Dwell time collapsed. Your unpatched high/crit queue is somebody's shopping list.

The RF bench went from curiosity to core capability this stretch, and the shared fault line is single-reference dependency. Ukraine's Lima system layers spoofed position fixes on top of wideband GNSS jamming and convinces drones and guided munitions they are over Peru -- spoofing beats jamming when the target has INS dead-reckoning, and Russian kit still leans on GNSS despite Chayka/eLoran fallbacks. The Turk Telekom holdover measurements show the civilian mirror image: once GNSS drops at a site, holdover runs out, timing degrades silently, and there is no re-sync grace -- every eNodeB on a single GNSS reference is one jammer away from cascading timing collapse. The bench gear to test all of this is now pocket-priced. The GPS-SDR-SIM author's pluto-crpa puts a two-element CRPA on AD9363 + Zynq-7010 -- adaptive weights computed on the PS, combined in the PL, re-transmitted at GPS L1 (1575.42 MHz) into a COTS receiver -- so build it, feed it a CW and a chirp jammer, and log the C/N0 delta and null depth versus jammer angle that everyone hand-waves; two elements means one spatial null, so test whether a two-source jammer defeats it outright. KrakenSDR V2 shed its Python layer for a C++ stack running MUSIC DoA concurrent with spectrum and audio demod on a Pi 5 -- and a spoofed receiver reports one position while a coherent array hands you the actual bearing to the spoofer's transmit site. Underneath it all, the ESP32-C5 wardriver now sweeps 2.4/5/6 GHz with a Pineapple Pager payload for under $20 straight to WiGLE, Mayhem commit 7756e195 extends PRALINE clock sync to the HackRF Pro's 25 MHz TCXO and kills SD corruption via single-beat SDIO IDMAC transfers (rerun any sweeps you trusted against the old display), SDRangel v8.2.0 rips out DSDcc/mbelib for a clean DSD demod covering DMR, D-Star, C4FM, M17, and dPMR, and with mt7996 firmware off the skip-picks list it is time to rebuild the out-of-tree mt76 driver and re-run the aircrack suite on MT7925 before trusting monitor mode in the field. EA4GPZ's new 1090 MHz receiver targets the weak-signal and message-collision cases where dump1090-class decoders fall over -- bench it against readsb on overlapping DF17 frames.

So here is the playbook we are running. Diff the mod_http2 fix commit, identify which shared structure loses the lock, then spray concurrent stream creation, RST_STREAM, GOAWAY, and window exhaustion against a pre-patch Apache -- and check whether the reverse proxies in front of your targets terminate h2 or pass it through, because reachability is the whole game; then check nghttp2 and h2o for the same teardown ordering. Lab a Mongo replica set, force primary transitions and stepdowns mid-sync, and watch whether the freed catch-up object can be reallocated with attacker-influenced BSON before the stale walk. Pull gVisor heads e45d53c7 and ab5f509c, trace which filestore path missed cleanup, and try holding descriptors across sandbox teardown on the pre-patch build. Audit what your editor auto-fetches before it fetches you. Replay Lima-style spoofing on the bench -- attenuators, shielded antenna only -- and measure how long a u-blox takes to lock the fake and whether integrity monitoring even blinks. Strap the coherent array to the car and diff the C++ DoA output against the old Python branch for calibration drift, because the Python build choked on concurrent load and the rewrite is your chance to catch it. Every fault line this month runs the same direction: lifetime bugs at transitions, trust anchors that were never load-bearing, and single references with no fallback. Shutdown is attack surface. Always was.