Teardown Season: Race Windows, Dead Decoders, and Keys That Outlived Their Welcome

CVE-2026-119618 is a race in Apache mod_http2's request handling that corrupts heap memory pre-auth, and Praetorian's writeup does not soften the blast radius: unauthenticated, network-reachable, every h2-enabled vhost a target until patched. It is not an outlier -- it is the dominant bug shape of the stretch: state torn down while somebody else still holds a reference. Ram Gall's WordPress CVE-2026-119977 puts the race inside the core update process itself, an unauthenticated condition spanning 4.7 through 7.1.3 with probes hitting within hours of the 7.1.4 fix -- twenty years of core and the patch path is the vuln [Ram Gall / Wordfence]. Datadog Security Labs' CVE-2026-118383 is the same class at the replication layer: an unauthenticated client triggers a use-after-free in MongoDB's primary catch-up path, exactly the bug that graduates to RCE with heap grooming. GPAC's gf_sg_proto_del (CVE-2026-128240, fixed in a2e5c62c) frees prototype scene-graph nodes during XMT teardown and then walks them again, and Google's gVisor crew quietly tightened device-cgroup confinement and filestore cleanup with no bulletin at all -- sandbox maintainers patching teardown paths silently is the classic tell. The Critical Thinking crew compressed the hunting angle into one line: a rig firing one request at a time will never see a race window that lives for a few milliseconds, so interleave requests against the same object or session [@ctbbpodcast]. @SinSinology found a remote race that escalates into a use-after-free the hard way, by hand, and is still grinding the exploit into shape. Single-threaded testing is not testing.

The parser layer rotted through in three places at once. php2shell -- CVE-2026-109618/109619, engine-level RCE plus a Heartbleed-style memory disclosure in PHP core, discovery credit to @calif_io and @lcfr_hax, two-word obituary ('PHP 2 SHELL') from @SinSinology -- put roughly 70 percent of the web in scope Wiz Research, and Praetorian's follow-up is the part the PoC reposters skipped: the RCE is conditional on build configuration and most circulating exploits are broken, so confirm against your own build before trusting a scanner hit. Assetnote did the decent half, open-sourcing the php2shell-scanner with detection logic published alongside, then shipped node2shell-scanner days later for CVE-2026-111497 ('Broccoli2shell'), where untrusted Brotli decompression becomes RCE in Node.js HTTP apps -- confirmed by streaming a ~23MB payload after probing Content-Encoding handling -- with commit 6a14c079 in upstream google/brotli as your diff anchor for every non-Node stack that bundles its own decoder. Meanwhile libdca, the unmaintained VideoLAN DTS decoder distros still ship even though VLC 4.0 dropped it, gave up two OOB reads in one week: bitstream.c's bitstream_fill_current() does tmp = *(state->buffer_start++) with zero end-of-buffer check, so a crafted .dts frame marches the pointer clean off the heap [oss-security]. Dead code, live bug class -- every media front-end linking it inherits the walk. Stack watchTowr's Barracuda chain on top (CVE-2026-116606/CVE-2026-111560, pre-auth remote root on the Email Security Gateway, no creds, no interaction) plus GPUStack's trivial auth bypass (CVE-2026-102895, before 2.2.0, live exploit attempts already in ISC's logs), and @0xLupin's rebrand -- 'Internet2Shell' -- stops sounding like a joke. The floor is the attack surface.

The supply-chain front asks a different question: not whether you can pop the parser, but whose token outlived its welcome. @wunderwuzzi23's LiteLLM timeline is brutal in the plain sense -- a backdoor key leaked May 27, the leak was found internally, the key was never revoked, and on October 10 an attacker used it to grab GitHub creds and poison releases, four-plus months between exposure and boom. 'Rotated' it was not. Cursor's marketplace breach ran the same play, credentials lifted from Fireworks pushing a malicious extension straight through the 'trusted' distribution channel -- your editor is a package manager now, so audit what it auto-fetches and pin what it executes. And the Depi chain is the one to read twice: @0xLupin gave @0xMadder and @_Worty six months to break