[ <- back-issue archive · live wire · issue #56 · HUB 24H · 2026-11-15 07:24 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #56   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/56.intel :: [ 2026-11-15 07:24 UTC ]
  • libdca bitstream_fill_current() heap walk-off -- second OOB read in the unmaintained VideoLAN DTS decoder: bitstream.c does tmp = *(state->buffer_start++) with zero end-of-buffer check, so a malformed .dts frame marches the pointer straight off the heap. Distro builds still ship the lib even though VLC 4.0 dropped it -- media parsers remain a live bug class [oss-security].
  • First libdca scale-factor OOB read -- the original disclosure: crafted DTS frame reaches OOB read in scale-factor parsing, reachable from any player or transcoder that still links the abandoned decoder. Two OOB reads in one week on dead code nobody audited for years; worth a fuzzing pass on the whole parser [oss-security].
  • Cursor marketplace supply-chain hijack -- stolen Fireworks AI credentials let attackers push a malicious Claude Code extension through Cursor's marketplace, so the 'trusted' distribution channel itself was the attack surface. Audit what your editor auto-fetches and pin extension hashes before the next round [BleepingComputer].
  • DPRK 'FaceStealer' disruption -- US takedown hit infrastructure behind $400M+ in crypto theft via identity spoofing and social engineering. Expect retooling and fresh lures, not a stop; the crew's playbook rotates faster than the sanctions [BleepingComputer].
  • Patch-to-exploit automation pointer -- Dawn Song's team demonstrated going from a patch diff to a working exploit, which is exactly the workflow you should be running against this week's silent commits. No code drop in the excerpt, but the methodology is the takeaway [@DanielMiessler].
  • CEO-invited overnight red-team -- @0xLupin claims a big-company CEO challenged him to an attack and he's already found multiple backdoor routes overnight while hunting a 'giga crit'. Unverified chatter, but a decent reminder that authorized targets still ship trivial backdoors [@0xLupin].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #56   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/56.possibilities :: [ 37 sources ]
  • Fuzz every distro-shipped consumer of libdca -- grab the two OOB reads (bitstream_fill_current() and scale-factor parsing), build a harness around dca_decode, and fuzz with a corpus of mutated .dts frames; the decoder is unmaintained so every sibling parser path is fair game. Check ffmpeg's dca wrapper and any GStreamer element still linking it [inspired by oss-security].
  • Hunt the negative-day window on silent patches -- run vitorfhc/videt against the major OSS repos in your watchlist to catch security fixes landing before a CVE is assigned, then diff the fix commit to reconstruct the primitive. The libdca pattern shows how long dead code rots before anyone looks [inspired by vitorfhc/videt].
  • Audit editor extension pipelines for credential-replay paths -- the Cursor/Fireworks breach shows marketplace push credentials are single points of failure; enumerate every service your toolchain auto-fetches from (extensions, plugins, themes) and test whether stolen vendor tokens can smuggle a package. Check for signing, hash pinning, and publish-key rotation [inspired by BleepingComputer].
  • Chain query-param PoC servers into header-gated XSS proofs -- JorianWoltjer/responder bakes custom response headers into a shareable URL, so wire it into CSP/allowlist bypass demos where you need a controlled origin serving attacker-chosen headers. The new nested autocomplete in SVG/XML widens payload-shaping options [inspired by JorianWoltjer/responder].
  • Diff gVisor's proc-umount and netns loopback merges -- the proc-umount process-handle work and host-net child netns loopback changes touch sandbox teardown and network isolation boundaries; grep for handle lifetime across umount races and loopback reachability from sandboxed children. Sandbox maintainers patching teardown paths quietly is the classic tell [inspired by google/gvisor].
  • Automate patch-to-exploit on this week's fix commits -- following the Dawn Song team methodology, feed recent security-fix diffs (libdca, gVisor, osv.dev RPM ordering) into a patch-analysis loop to reconstruct the vulnerable input and build a PoC before the advisory drops [inspired by @DanielMiessler].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #56   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/56.github :: [ code & repo tradecraft ]

Repo traffic splits between sandbox hardening at Google and small hunter tooling shipping quietly elsewhere. gVisor landed proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration in one push -- three isolation-boundary touches with no bulletin attached, which is exactly the pattern worth diffing. Meanwhile osv.dev locked Cloud Run to a least-privilege service account and fixed RPM version ordering for the RHEL family, and xssdoctor dropped two fresh tarball-provenance scaffolds that look like baselines for diffing dependency tampering.

  • vitorfhc/videt -- watches major OSS repos for silent security patches landing pre-CVE, then checks whether the fix is actually reachable/exploitable. Negative-day hunting harness; point it at your favorite maintainers and let it surface the quiet fixes.
  • JorianWoltjer/responder -- query-param PoC server spinning up shareable exploit pages with custom response headers baked into the URL; latest commits add nested autocomplete in SVG/XML. Handy for header-gated XSS and CSP-bypass demos where you need a controlled origin.
  • google/gvisor -- proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration all merged in the latest push. Teardown and lock semantics are where sandbox escapes live; grab the diffs.
  • google/osv.dev -- least-privilege Cloud Run service account, RPM version-ordering fixes for TuxCare/CentOS/OracleLinux/RHEL, and goose pooled-SQL repair. The RPM ordering fix matters if you've been triaging vuln matches against RHEL-family packages.
  • xssdoctor/muse-tarball-ua-parent-20261114 -- bun-built static dist/index.html with zero scripts or external loads, positioned as a 'package provenance' baseline for diffing tarball or dependency tampering against a known-clean page. Empty shell now, but the tamper-diff workflow is the point.