[ <- back-issue archive · live wire · issue #40 · HUB 24H · 2026-11-15 03:16 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #40   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/40.intel :: [ 2026-11-15 03:16 UTC ]
  • libdca OOB read in scale-factor parsing -- The unmaintained VideoLAN DTS decoder has a second out-of-bounds read: bitstream_fill_current() in bitstream.c does tmp = *(state->buffer_start++) with zero end-of-buffer check, so a crafted .dts frame walks the pointer straight off the heap. Dropped from VLC 4.0 but still shipped by distros as a library -- media parsers remain a live bug class nobody is patching [seclists.org].
  • Cursor marketplace supply-chain hijack -- Stolen credentials from Fireworks AI let attackers push a malicious Claude Code extension through Cursor's marketplace, meaning the editor's auto-fetch pipeline executed attacker code on dev boxes. Audit what your tooling silently pulls from 'trusted' registries before your CI does it for you [bleepingcomputer.com].
  • DPRK 'FaceStealer' disruption -- US infrastructure takedown hit the social-engineering crew behind $400M+ in crypto theft via spoofed identities. Expect retooling and fresh lures within weeks, not a stop; the tradecraft (identity spoofing, urgent-task pretexting) is unchanged and still works on your helpdesk [bleepingcomputer.com].
  • Patch-to-exploit automation from Dawn Song's team -- Miessler flagged work going from a patch diff straight to a working exploit. That is the exact workflow you should be running manually against every silent fix that lands without a CVE -- the negative-day window between commit and advisory is where the free bugs live [x.com].
  • Red-team all-nighter -- @0xLupin claims multiple backdoor footholds mid-engagement against a CEO-challenged target. No primitives disclosed yet -- hand-waving until the writeup drops, but the GraphQL-plus-cookie angle is a classic auth-boundary hunting pattern worth mirroring on your own scope [x.com].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #40   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/40.possibilities :: [ 76 sources ]
  • Fuzz every distro-shipped copy of libdca -- Grab the scale-factor parsing path and bitstream_fill_current() in bitstream.c, build with ASAN, and feed mutated DTS frames; since VLC dropped it but distros still package it, check ffmpeg's dca decoder and any GStreamer plugin for the same unchecked buffer_start++ walk-off pattern [inspired by seclists.org].
  • Diff sibling bitstream decoders for missing bounds checks -- libdca is unmaintained, so grep other abandoned VideoLAN-era decoders (liba52, libmad forks) for the identical *(ptr++) idiom with no end-of-buffer guard; abandoned codec libraries are a target-rich, CVE-poor hunting ground [inspired by seclists.org].
  • Audit extension-marketplace publish paths -- The Cursor breach ran on stolen vendor credentials pushing through a marketplace; enumerate every editor/plugin registry your org consumes (VS Code, JetBrains, Cursor, npm-adjacent tooling) and check whether publishing is gated by anything stronger than a bearer token [inspired by bleepingcomputer.com].
  • Run negative-day triage on silent patches -- Point a watcher at major OSS repos for security-flavored commits landing before CVE assignment, then diff for the fix and test reachability; vitorfhc/videt is a working harness for exactly this window, clone it and widen the repo list [inspired by vitorfhc/videt].
  • Hunt header-gated XSS with a query-param response server -- JorianWoltjer/responder bakes custom response headers into a shareable URL, including nested autocomplete in SVG/XML -- perfect for proving CSP/header-gated injection on bug bounty targets where you need the victim's browser to hit your exact header set [inspired by jorianwoltjer/responder].
  • Probe GraphQL auth boundaries on session cookies -- Mirror the cookie-plus-GraphQL angle: look for queries that accept account identifiers from client input instead of the session, then chain cross-object references to read other users' data -- the classic IDOR-through-GraphQL that still pays [inspired by x.com].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #40   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/40.github :: [ code & repo tradecraft ]

Thin night on the public blogs, so the wire desk spent it watching what actually landed in git. The diff stream split three ways: sandbox maintainers quietly tightening isolation and lock behavior, a researcher shipping a negative-day patch watcher that automates the exact hunting loop we all do by hand, and a couple of Bun-built static preview repos with pinned runtime deps that are pure supply-chain seams until proven otherwise. No conferenceware, no hype -- just harnesses and hardening commits worth pulling before breakfast.

  • vitorfhc/videt -- Python watcher that flags silent security patches in major OSS repos before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. This is the negative-day pipeline in a box; clone it, widen the repo list, and let it hand you unreported bugs.
  • google/gvisor -- Latest merges add proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration. Sandbox maintainers bolting locks onto teardown and netns paths without a bulletin is the classic tell that somebody found a containment gap -- diff the umount handle lifetime against your own container escapes.
  • JorianWoltjer/responder -- Query-param PoC server that spins shareable HTML/JS exploit pages with custom response headers baked into the URL; fresh commits add nested autocomplete in SVG/XML plus a small-screen scrolling fix. Tight tool for header-gated XSS proofs on bounty targets.
  • xssdoctor/muse-grid-card-preview-20261114 -- Static grid card preview fixture where bun install pulls a pinned runtime dep (muse-grid-card-runtime-20261114) and build writes dist/index.html. Zero security surface on its face, but the pinned-dependency import chain is exactly the seam the Cursor breach taught us to audit.
  • google/osv.dev -- Recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling. Version-ordering fixes in a vulnerability DB are quietly load-bearing -- a wrong sort can suppress a matching advisory, worth a 10-minute diff.