[ <- back-issue archive · live wire · issue #52 · HUB 24H · 2026-11-15 07:16 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #52   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/52.intel :: [ 2026-11-15 07:16 UTC ]
  • Cursor marketplace supply-chain breach -- Attackers lifted credentials from Fireworks AI and pushed a malicious Claude Code extension straight through Cursor's marketplace. Your editor is a package manager now; audit what it auto-fetches and pin what it executes [BleepingComputer].
  • libdca second OOB read -- bitstream_fill_current() in bitstream.c does tmp = *(state->buffer_start++) with zero end-of-buffer check, so a malformed .dts frame walks the pointer clean off the heap. Unmaintained, dropped from VLC 4.0, still shipped by distros -- the perfect negative-day target [oss-security].
  • libdca scale-factor OOB read -- Companion disclosure: OOB read in scale-factor parsing reachable from a single crafted DTS frame. Two heap walks in one dead decoder means the whole parse path is unguarded; media parsers stay a live RCE-ish bug class [oss-security].
  • DPRK 'FaceStealer' disruption -- US hit the infrastructure behind $400M+ in identity-spoofed crypto theft. Disruption, not death -- expect retooled lures and fresh personas inside a fortnight [BleepingComputer].
  • Patch-to-exploit automation pointer -- Dawn Song's crew is turning patch diffs into working exploits. No code drop in the excerpt, but the direction is clear: the commit-to-CVE window is shrinking, so silent-fix hunting pays [Dawn Song team via @DanielMiessler].
  • PostScript interpreter walkthrough -- RPN stack machine, Forth lineage, printer-control basics. Solid primer before you go poking at PJL/PostScript attack surface on network printers [Hackaday].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #52   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/52.possibilities :: [ 70 sources ]
  • Fuzz the libdca bitstream reader -- Grab bitstream.c, wrap bitstream_fill_current() and the scale-factor parser in an ASan harness, and feed mutated DTS frames until the heap walk becomes a controlled read. Then check which distro builds still link it into media frontends [inspired by oss-security].
  • Diff sibling DTS decoders for the same guard -- libdca is dead, but ffmpeg's DTS parser and libavcodec share lineage; grep their scale-factor and bitstream-fill paths for the missing bounds check twin before somebody else does [inspired by oss-security].
  • Audit editor extension pipelines like package registries -- Map every marketplace that auto-syncs extensions (Cursor, VS Code, JetBrains), check whether publisher tokens are scoped per-extension, and test whether a revoked upstream credential still serves old versions [inspired by BleepingComputer].
  • Hunt negative-day silent patches -- Run videt against the major OSS repos it watches, then manually triage any commit that touches bounds checks or parser loops without a linked advisory; the libdca pattern shows unmaintained codecs are where fixes never land at all [inspired by vitorfhc/videt].
  • Replay PJL/PostScript printer attacks -- Build the interpreter from the walkthrough, then port classic PostScript file-read and PJL directory-traversal payloads against modern network printers; two decades of firmware and the stack machine is still there [inspired by Hackaday].
  • Chain query-param response headers into header-gated XSS -- Spin up responder pages with custom response headers baked into the URL, then target CSP or CORS configs that trust specific header values; the new SVG/XML nested autocomplete widens the payload surface [inspired by JorianWoltjer/responder].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #52   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/52.github :: [ code & repo tradecraft ]

The repo wire this stretch is all about watching the watchers: videt formalizes the negative-day hunt between silent commit and assigned CVE, responder keeps sharpening shareable XSS proof pages, and gVisor quietly tightens netns and file-lock teardown paths while osv.dev locks down its own Cloud Run service account. Meanwhile two fresh xssdoctor repos pull a pinned runtime dep at build time -- a small supply-chain seam worth a two-minute diff given what just happened to Cursor's marketplace.

  • vitorfhc/videt -- Python watcher that flags silent security patches landing in major OSS repos before a CVE exists, then checks reachability. Direct tooling for the commit-to-advisory gap; point it at media codecs first.
  • JorianWoltjer/responder -- Query-param PoC server baking custom response headers into shareable URLs; latest push adds nested autocomplete in SVG/XML. Clean harness for header-gated XSS demos.
  • google/gvisor -- proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration. Sandbox teardown and lock semantics getting tighter -- diff the umount path for handle-lifetime races.
  • google/osv.dev -- Least-privilege service account for Cloud Run, RPM version-ordering fixes for TuxCare/CentOS/OracleLinux/RHEL, and goose pooled-SQL repair. Version-comparison fixes matter when you're poisoning advisory lookups.
  • xssdoctor/muse-grid-card-preview-20261114 -- Static card preview that imports copy from muse-grid-card-runtime-20261114 at build time. Pinned runtime dep pulled by bun install -- exactly the auto-fetch pattern the Cursor breach just proved dangerous.