[ <- back-issue archive · live wire · issue #5 · HUB 7D · 2026-11-14 08:58 UTC ]
 .-.                   .-. 
(: `-------------------' :)
 )   intel brief // #5   ( 
(: .-------------------. :)
 `-'                   `-'
> /var/archive/digest/5.intel :: [ 2026-11-14 08:58 UTC ]
  • [James Kettle / @albinowax] "Blind trust: stealing credentials through CSP" -- the big idea of the week: CSP allowlists that include a host serving user-controllable content (JSONP endpoints, upload buckets, open redirects) convert an HTML injection into credential theft even without script execution; the safety net becomes the exfil channel.
  • [Wordfence / Ram Gall] 497 vulnerabilities across 312 plugins + 1 theme landed in the Intelligence DB last week, with 218 credited researchers -- the WordPress plugin ecosystem remains the highest-volume CVE firehose and the best hunting ground for pre-CVE diffing.
  • [Wordfence / Ram Gall] PSA on CVE-2026-119618: critical Apache HTTP/2 module RCE -- patch priority for anyone hosting WordPress behind httpd with mod_http2 enabled; assume mass scanning already started.
  • [Critical Thinking Podcast ep.200 / Nick Copi] Cloud hacking deep-dive: what actually counts as a cloud finding, how threat models shift when the "vulnerability" is an over-permissive trust policy or an IAM misconfiguration rather than a code bug.
  • [@xssdoctor] shipped git-cve-2026-113408-poc plus a whole battery of inert Git fixtures (partial-clone promisor upload-pack, option-injection filenames, CVE-2025-48384 submodule hook execution, nested-config probes) -- a coordinated push against Git client trust boundaries.
  • [@vitorfhc] vdet update pushes the "negative-day" thesis: watch major OSS repos for silent security patches shipped before a CVE exists, then verify exploitability -- pre-CVE intelligence as a repeatable pipeline.
  • [@dawgyg] AppleResearch (510★ in days) dumps raw macOS vulnerability research the author считает should have been patched but fell below bounty thresholds -- a rare public corpus of Apple bug classes.
  • [Daniel Miessler] The Bitter Wall / Bitter Lesson Generalized: model capability now plateaus at "what you can articulate"; the differentiation moves to harness/orchestration design -- relevant to how we build AI-assisted recon and triage.
 .-.                     .-. 
(: `---------------------' :)
 )   possibilities // #5   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/5.possibilities :: [ 37 sources ]
  • Git-aware attack surface sweep inspired by [@xssdoctor]: enumerate every product that shells out to git (CI runners, Gerrit/GitLab/Gitea mirrors, IDE integrations, security scanners pulling repos) and test malicious server responses at protocol v2 -- specifically unborn HEAD symref handling and branch-update resolution escaping .git, the CVE-2026-113408 pattern.
  • Option-injection hunting per [@xssdoctor] muse-git-option-path: grep internal tooling/backup scripts/scanners for git invocations building argv from repo paths or branch names without a -- terminator; filenames or refs starting with - (--upload-pack=, --config=, -c core.pager=) become command execution.
  • Submodule/clone-hook RCE chain from [@xssdoctor] muse-git-cve-2025-48384-*: audit any pipeline doing git clone --recurse-submodules on untrusted repos; craft submodule content that gets installed as a checkout hook, and test whether hardened configs (protocol.file.allow, core.hooksPath) actually block it.
  • CSP-allowlist credential theft per [James Kettle] + the freshened matcher in [@renniepak] CSPBypass (now handles scheme-relative and multi-directive policies): for any target, diff its script-src/connect-src allowlist against known JSONP, AngularJS-on-CDN, upload-host, and open-redirect gadgets, then build a no-JS exfil chain that abuses report-uri/form-action/img-src allowlisted origins to capture tokens.
  • Negative-day plugin hunting modeled on [@vitorfhc] vdet, aimed at the [Wordfence] 497-vuln backlog: mirror WordPress.org SVN, diff consecutive plugin tags, flag releases with security-shaped changelogs ("sanitize", "capability check", "nonce") but no CVE, then verify exploitability against the previous version before disclosure.
  • Apache HTTP/2 CVE-2026-119618 blast-radius recon per [Wordfence]: fingerprint mod_http2 + h2c upgrade support across WordPress hosting fleets, write a nuclei/httpx probe for HTTP/2 preface handling, and prioritize shared-hosting front ends where one httpd serves thousands of vhosts.
  • Cloud threat-modeling per [Critical Thinking / Nick Copi]: shift from "find the bug" to "find the trust": enumerate CI OIDC trust policies with wildcard sub claims, cross-account sts:AssumeRole graphs, and SSRF→IMDSv1 leftovers; treat every over-permissive role as a reportable finding with a concrete escalation path.
  • Tooling build: fork [@JorianWoltjer] responder (now supports loading content from a URL and Content-Length) as the delivery layer for CSP/credential-theft PoCs -- query-param-driven headers make it trivial to spin up per-target allowlisted-origin simulations mid-engagement.
 .-.                    .-. 
(: `--------------------' :)
 )   github brief // #5   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/5.github :: [ code & repo tradecraft ]

This window is defined less by volume than by intent -- the security-relevant GitHub activity clusters tightly around two researchers building *targeted lab apparatus* rather than broad tools, with [@xssdoctor] producing an unusually disciplined set of Git attack fixtures (every one explicitly scoped as inert, loopback-only, and marker-writing to prove impact without persistence) alongside the headline CVE-2026-113408 unborn-HEAD-symref PoC, and [@vitorfhc] iterating on vdet as a pre-CVE "negative-day" monitor; the surrounding noise from Google's monorepos (XNNPACK, Dawn, ANGLE, XLS, Nomulus, grain, mug, goonami-scanner) is routine engineering with only goonami-scanner's move to a declarative fingerprinter being security-adjacent, while Caido continues shipping platform plumbing (SDK v0.59.1, Wsdler plugin merge into the store, checksum-verified tool installer) that matters mostly as future extension surface. The trend: researchers are productizing *reproducibility* -- fixtures, harnesses, and detection pipelines -- instead of one-off advisories, and the most interesting new arrival is [@dawgyg]'s 510-star AppleResearch dump of unpatched-below-threshold macOS findings, which is effectively a free bug-class syllabus. Immediate inspection: xssdoctor/git-cve-2026-113408-poc, the muse-git-* fixture family, and vitorfhc/videt.

  • Git client trust boundaries are the theme of the week: [@xssdoctor] released 7 new repos in one window -- git-cve-2026-113408-poc (protocol-v2 smart-HTTP unborn HEAD symref escaping .git), muse-git-local-partial-archive-20261113 (CVE-2024-32004 promisor upload-pack command execution), muse-git-option-path-20261113 (argv option injection via --prefixed filenames), and the muse-git-cve-2025-48384 parent/sub pair (submodule content installed as a checkout hook) -- all deliberately inert lab fixtures.
  • Pre-CVE detection is maturing: [@vitorfhc] vdet (Python, 7★) refreshed its README to formalize the "negative-day" window -- silent security patches shipped before CVE assignment -- and the exploitability check that follows; this is the pipeline every WordPress-plugin hunter should be stealing.
  • Platform/tooling churn worth watching: [@caido] tagged sdk-js for v0.59.1 and merged the Wsdler plugin into caido/store (new extension surface + capture menu docs), [@renniepak] CSPBypass fixed its matcher for scheme-relative and multi-directive policies (directly complements the Kettle CSP research), and [@JorianWoltjer] responder added URL-loaded content and Content-Length support for faster PoC hosting.
  • High-signal new corpus: [@dawgyg] AppleResearch (C, 510★) -- raw macOS vulnerability research that never met bounty thresholds; mine it for bug classes portable to iOS/XPC surfaces.
  • Routine-but-notable: [@google] goonami-scanner dropped legacy binproto signatures and moved the webidentity fingerprinter to a declarative engine -- a cleaner model for anyone building extensible vuln scanners.