[ <- back-issue archive · live wire · issue #44 · HUB 24H · 2026-11-15 05:04 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #44   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/44.intel :: [ 2026-11-15 05:04 UTC ]
  • libdca second OOB read -- bitstream_fill_current() in bitstream.c does tmp = *(state->buffer_start++) with zero end-of-buffer check, so a malformed .dts frame walks the pointer clean off the heap. Second OOB in the same unmaintained DTS decoder this week; VLC 4.0 already dropped it but distros still ship the library, so every media front-end that touches DTS is a live crash-or-worse oracle [seclists.org].
  • libdca scale-factor OOB read -- the original advisory nails an out-of-bounds read in scale-factor parsing reachable from a single crafted DTS frame. 'Unmaintained' is the whole story here: no maintainer, no patch, no CVE pressure -- grab the fuzzer and go [seclists.org].
  • Cursor marketplace supply-chain breach -- stolen Fireworks AI credentials let attackers push a malicious Claude Code extension through Cursor's marketplace, meaning editor auto-fetch pipelines are now a proven hijack path. Audit what your own IDE silently pulls on startup; the 'marketplace' was the trust boundary that broke [bleepingcomputer.com].
  • DPRK 'FaceStealer' disruption -- US takedown hit infrastructure behind $400M+ in spoofed-identity crypto theft. Disruption rarely means dead; expect retooled lures and fresh persona kits within weeks, so tighten your verification paths for 'known' contacts now [bleepingcomputer.com].
  • Patch-to-exploit automation pointer -- Miessler flags Dawn Song's team turning a patch diff into a working exploit. No code drop in the excerpt, but the direction is clear: automated diff -> primitive -> PoC pipelines are coming for every silent vendor 'fix' [x.com].
  • CEO-authorized all-nighter -- @0xLupin claims a big-company chief invited an attack and he's already found multiple backdoor routes overnight, still hunting a 'giga crit'. Unverified red-team chatter -- no bug, no PoC, treat as atmosphere until something drops [x.com].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #44   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/44.possibilities :: [ 74 sources ]
  • Fuzz every DTS frame parser descended from libdca -- the scale-factor and bitstream_fill_current() OOB reads prove the whole decode path lacks bounds discipline; build a libFuzzer harness around dca_frame_parse and scalefactor handling, then diff ffmpeg's DTS decoder and any distro-patched libdca fork for the same unchecked pointer walks [inspired by seclists.org].
  • Hunt sibling bitstream readers for the same `*(buffer_start++)` pattern -- grep liba52, libmad, and other unmaintained VideoLAN-adjacent audio decoders for increment-before-check idioms in their fill/read helpers; the bug class almost never lives in one codec [inspired by seclists.org].
  • Audit editor extension marketplaces for unsigned-push paths -- Cursor's breach shows a stolen upstream credential is enough to land code on developer machines; map your target's plugin pipeline for missing signing, pinning, or publisher verification, and check whether installed extensions auto-update without user consent [inspired by bleepingcomputer.com].
  • Run videt against high-value OSS repos and race the advisory -- the negative-day window between silent fix commit and CVE assignment is where dupes die and originals get paid; point it at media parsers and sandbox projects given this week's libdca and gVisor activity [inspired by vitorfhc/videt].
  • Chain header-gated XSS with responder's URL-baked response headers -- the nested autocomplete in SVG/XML additions are fresh attack surface; use it to test parser differentials between browsers on SVG content-type handling and CORS preflight responses [inspired by jorianwoltjer/responder].
  • Diff gVisor's proc-umount and file-lock wait registration merges -- sandbox maintainers tightening teardown and lock paths usually means somebody found a handle-retention or deadlock escape; replay the merges and hammer umount-under-contention and lock-waiter ordering [inspired by google/gvisor].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #44   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/44.github :: [ code & repo tradecraft ]

The repo wire this stretch is mostly scaffolding and wordlist refreshes, but three pushes carry real signal: vitorfhc's videt formalizes negative-day hunting by watching OSS repos for silent security patches before CVEs land, JorianWoltjer's responder keeps sharpening its URL-parameterized exploit-page server with new SVG/XML autocomplete nesting, and gVisor merged proc-umount handle work plus file-lock wait registration -- classic teardown-hardening commits worth replaying under contention. Meanwhile xssdoctor's muse-grid preview repos pull a pinned runtime dependency at build time, which is exactly the kind of supply-chain seam that bit Cursor this week.

  • vitorfhc/videt -- Python watcher that flags silent security fixes in major OSS repos before a CVE exists, then probes whether the fix is actually reachable/exploitable. The negative-day window is where original research lives; clone it and point it at media parsers [vitorfhc/videt].
  • JorianWoltjer/responder -- shareable HTML/JS exploit pages with custom response headers encoded straight into the query string; latest commits add nested autocomplete in SVG/XML plus a small-screen scrolling fix. Ideal for proving header-gated XSS and content-type parser differentials [jorianwoltjer/responder].
  • google/gvisor -- container application kernel; latest merges cover proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration. Teardown-order and lock-waiter changes are prime escape-hunting territory [google/gvisor].
  • google/osv.dev -- vulnerability DB service; commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling. The RPM ordering fix matters if you've been trusting osv's version-range matching for RHEL-family triage [google/osv.dev].
  • xssdoctor/muse-grid-card-preview-20261114 -- static card preview fixture where bun install pulls a pinned runtime dep and the build imports copy from muse-grid-card-runtime-20261114 before writing dist/index.html. A small supply-chain seam worth diffing given this week's marketplace hijack news [xssdoctor/muse-grid-card-preview-20261114].