Teardown Races, Stolen Tokens, and the Shrinking Negative Day

MongoDB's CVE-2026-118383 is the month in miniature: an unauthenticated client pokes the primary catch-up path, the server frees an object mid-transition, and replication state walks a freed slot. GPAC's CVE-2026-128240 runs the same play at the parser layer -- gf_sg_proto_del rips prototype scene-graph nodes out during XMT scene teardown, then the code strolls back through them (CWE-416, 'crash-only' per the advisory, fixed in a2e5c62c). Pile mod_http2's CVE-2026-119618 race-to-heap-corruption and WordPress's CVE-2026-119977 upgrade-window race on top -- an unauthenticated race in the core update process spanning 4.7 through 7.1.3, fixed in 7.1.4, twenty years of core and the patch path is the vuln -- and the fault line writes itself: every one of these fires during a state transition. Catch-up. Teardown. Upgrade. Umount. Fuzzers feed steady-state frames all day; almost nobody races the seams, and the gVisor crew quietly tightening proc-umount and file-lock wait registration with no bulletin is the tell -- when sandbox maintainers patch teardown paths in silence, assume somebody already worked out how to hold the handle open across the transition.

The disclosure model inverted while nobody was watching. N-able's '4EverAble2Shell' dropped cryptominers within hours of PoC release, and 19 of 21 popped hosts were running the latest update -- the 'fix' is bypassable and the version matrix is fiction. That is the negative-day window in the flesh: the gap between a silent fix commit and its CVE is hours, not weeks, and videt exists precisely to flag OSS security fixes that land before advisory assignment and check reachability. Miessler is already pointing at Dawn Song's group turning a patch diff into a working exploit (no public code drop yet, but the direction is clear), and the FBI flash on the open-source chaining tool Artex clocks recon -> exploit -> privileged access at 'machine speed' -- under three hours [The Record]. Diff -> primitive -> PoC pipelines are coming for every quiet vendor 'fix'. The commit is the advisory now. Wait for the CVE and you're hunting a corpse.

Trust rots in the same pattern: delegate your authority to a list, and the list becomes the pivot. Kettle's 'Blind Trust' research shows a CSP allowlist is a pre-approved exfil pipe the second any allowlisted host serves JSONP, an upload path, or an open redirect -- blocked XSS flips straight back into token theft, and renniepak/CSPBypass's matcher (now handling scheme-relative and multiple directives) automates the enumeration half. Cursor's marketplace breach ran the identical pivot at the supply-chain layer: one stolen upstream credential was enough to land a malicious extension on developer machines, because editor auto-fetch pipelines inherit your authority without ever asking BleepingComputer]. GPUStack's [CVE-2026-102895 is the degenerate case -- a trivial auth bypass in anything before 2.2.0 that turns an exposed GPU fleet manager into an open cluster console, with ISC already logging probes -- and the DPRK 'FaceStealer' disruption is a reminder that 'known contact' is itself an allowlist nobody audits. Your CSP policy, your plugin registry, your cluster login, your contact list: same object. Enumerate all of it like external attack surface, because that is what it is.

Down at the physical layer, the ugliest finding is that timing is a kill primitive. Calnex ITSF 2026 field measurements on Turk Telekom show base-station sync rotting the instant GNSS drops -- no re-sync grace, holdover exhausts, degradation running silent underneath live traffic -- which is exactly the failure a $30 L1 spoofer produces on demand. Galileo's OSNMA puts crypto on the nav message and nothing on the carrier, so strong jamming degrades it anyway, and Ukraine's Lima system layers spoofing on top of jamming to walk drones an ocean away. Meanwhile the bench got fast: the KrakenSDR V2 suite shed its Python layer for C++ and runs MUSIC DoA concurrent with demod, PortaPack nightly n_261115 (7756e195) kills SD corruption with single-beat SDIO IDMAC transfers and pins PRALINE TX/RX sync to the HackRF Pro's internal 25 MHz TCXO, a bare ESP32 demods 5 GHz analog FPV, and uwifi puts monitor-mode capture on macOS without touching a kernel extension. Clone pluto-crpa -- AD9363 plus Zynq-7010, weights computed on the PS, combining in the PL -- replay a GPS-SDR-SIM scenario through a HackRF, and you can put a measured kill-clock on any GNSS-dependent target from a bench that fits in a backpack.

The parser graveyard keeps paying out underneath all of it. libdca's bitstream_fill_current() does tmp = *(state->buffer_start++) with zero end-of-buffer check, so one crafted .dts frame marches the pointer clean off the heap -- the second OOB read in the same abandoned VideoLAN decoder this month, hot on the heels of the scale-factor parse walk, and since VLC 4.0 dropped the lib while distros still ship it, every media front-end linking it inherits the bug. The increment-before-check idiom almost never lives in one codec: grep liba52, libmad, and ffmpeg's DTS decoder for the same unchecked fill helpers. The fresh RCE crop splits into the conditional and the already-firing. php2shell (CVE-2026-109618/109619) only lands on particular SAPI, allocator, and array-handling configs and most circulating PoCs are broken, so confirm against your own build -- Assetnote's scanner logic (62-level-deep array keys, 1MiB-20MiB probes) exists for exactly that -- before wasting a payload. 'Broccoli2shell' (CVE-2026-111497) sits in the Brotli decoder itself -- node2shell-scanner proves the point by streaming a ~23MB payload -- commit 6a14c079 is the diff anchor, and every HTTP stack bundling its own brotli is a twin hunt. ZDI says three distinct bugs shipped under the single PeopleSoft CVE-2026-35273 -- ShinyHunters are mass-exploiting the known one, which makes the two unreported siblings pre-0-day for anyone who diffs the June 2026 patch set. And when nothing is conditional at all, Barracuda ESG hands you pre-auth root on a mail gateway (CVE-2026-116606/CVE-2026-111560) -- no creds, no interaction, just a root shell where the mail comes in.

The playbook across all of it is unglamorous and it works. Fuzz the transitions, not the steady state: race teardown order, catch-up, upgrade windows, and umount under thread contention, because that is where MongoDB, GPAC, mod_http2, and WordPress all broke. Treat every silent commit as a disclosure event -- point videt at the parser and sandbox repos you care about, because the N-able window proved the commit-to-advisory gap is measured in hours. Treat every allowlist, marketplace, and version matrix as a pre-approved pivot and enumerate it before an attacker does. And bench the RF kill-clock now: holdover decay, nulling limits, jammer power thresholds -- the numbers nobody publishes until a base station falls over. The bug classes cluster because the architecture is the same everywhere: orderly-transition assumptions plus delegated trust. Attackers stopped attacking the code. They attack the moment between states.