[ <- back-issue archive · live wire · issue #6 · HUB 30D · 2026-11-14 08:59 UTC ]
 .-.                   .-. 
(: `-------------------' :)
 )   intel brief // #6   ( 
(: .-------------------. :)
 `-'                   `-'
> /var/archive/digest/6.intel :: [ 2026-11-14 08:59 UTC ]
  • WordPress 7.1.4 (Oct 28, 2026) patched 22 flaws including an unauthenticated race-condition RCE in the core upgrade path, and Wordfence is already seeing active probing for it -- this is the highest-urgency item in the window [Ram Gall / Wordfence].
  • Two infrastructure-grade RCEs landed back-to-back: Apache HTTP/2 CVE-2026-119618 (mod_http2, RCE) and the Brotli CVE-2026-111497 "HTTP2Shell" chain -- both directly relevant to shared WordPress hosting where nobody controls the httpd build [Wordfence].
  • @albinowax dropped three bangers: CSP allow-list abuse for credential theft ("Blind trust"), a CRLF-powered desync check that escalates plain header injection to critical via a single prompt, and "Scalable Vector Grief" -- 6 of 8 SVG sanitizers bypassed, with a response *header* alone executing JS in Firefox [James Kettle].
  • WordPress ecosystem volume remains brutal: 497 vulns across 312 plugins in one week, 549 the week prior -- plugin-level hunting is still a numbers game with a very low signal bar [Wordfence Intelligence].
  • Critical Thinking Ep. 200 (Cloud Hacking w/ Nick Copi) and Ep. 197 ("800 Bugs w/ DeepSeek + Local Model Hacks") are the two episodes worth your time -- cloud threat-model framing and local-model-driven bug volume [Critical Thinking Podcast].
  • @rez0__ took 2nd overall at Google Bugswat Singapore against ~50 hackers -- worth watching what he publishes next [@rez0__].
  • GitHub signal is dominated by @xssdoctor's Git client-side fixture corpus and @vitorfhc's "negative-day" pre-CVE detector -- both are pre-disclosure hunting machinery, not retro PoCs.
 .-.                     .-. 
(: `---------------------' :)
 )   possibilities // #6   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/6.possibilities :: [ 75 sources ]
  • Git client-side RCE/escape sweep: @xssdoctor's fixture set now covers unborn HEAD symref escape (CVE-2026-113408), partial-clone promisor upload-pack execution (CVE-2024-32004), submodule hook injection (CVE-2025-48384), and option-injection via filenames beginning with -. Audit every service that clones attacker-influenced repos: CI runners, dependency bots, IDE/SCM plugins, monorepo vendoring scripts, AI coding agents with git clone tools. Build a argv-fuzzing shim that wraps git and logs missing -- terminators.
  • CSP allow-list → credential theft (per @albinowax "Blind trust"): enumerate targets whose CSP whitelists third-party hosts, then diff those hosts for JSONP endpoints, open redirects, user-content subdomains, and Angular/library sinks. Pair with [renniepak/CSPBypass]'s fresh matcher fix for scheme-relative and multi-directive policies -- its parser was just corrected, meaning previously-missed policies now resolve.
  • CRLF header-injection escalation: @albinowax's new check turns boring header injection into desync. Re-audit every parameter that lands in a response or forwarded header -- filename fields, redirect/locale params, X-Forwarded-Host, CDN cache keys -- and instrument a crawler to flag any reflected CR/LF into headers, then test for response splitting and cache poisoning rather than blind XSS.
  • SVG sanitizer bypass at scale: test upload/preview pipelines against the "Scalable Vector Grief" methodology -- the kill shot isn't in the XML, it's in how the response is *served*. Focus on attacker-influenced Content-Type, Content-Disposition, multipart, and charset headers on any endpoint that reflects user SVG (avatars, invoices, e-signature, chart export).
  • Shared-hosting HTTP/2 & Brotli blast radius: mass-fingerprint mod_http2 versions and Brotli handling behind WordPress/asset hosts, prioritize multi-tenant hosts where a single httpd RCE = hundreds of tenants. Build a low-noise h2 prober that avoids crashing production.
  • Upgrade-window race replication: WordPress's unauthenticated TOCTOU in the core updater is a pattern, not a one-off. Hunt the same shape in plugin/theme auto-updaters, WP-CLI wrappers, and other PHP CMSes (Joomla/Drupal/October) -- look for update flows that write-then-verify with an attacker-observable window and no locking.
  • Negative-day pipeline (inspired by @vitorfhc/videt): watch high-value OSS repos for commits that touch sanitizers, parsers, authz, or deserializers with no CVE, no advisory, and terse messages. Auto-diff, auto-classify exploitability, auto-draft a PoC skeleton -- you beat the advisory feed by days.
  • MCP/agent attack surface: [assetnote/assetnote-mcp-server-public-docs] documents an AI-to-attack-surface bridge, and [7urb0/intent-anchor] exists precisely because agents drift from constraints. Test MCP servers for prompt-injection → privileged-action chains, and probe approval boundaries where "read-only" tools can be steered into mutations.
 .-.                    .-. 
(: `--------------------' :)
 )   github brief // #6   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/6.github :: [ code & repo tradecraft ]

This window's GitHub telemetry reads as a coordinated pivot toward *pre-disclosure, client-side, and tooling-layer* tradecraft rather than headline CVE churn. @xssdoctor is the dominant actor, shipping a coherent corpus of inert, marker-only Git fixtures -- git-cve-2026-113408-poc (unborn HEAD symref escape), muse-git-local-partial-archive-20261113 (CVE-2024-32004 promisor upload-pack), the paired muse-git-cve-2025-48384-parent/sub-20261113 submodule hook-injection set, muse-git-option-path-20261113 (-- terminator / option injection), and muse-nested-git-config-probe-20261113 -- all deliberately sandboxed with fixed-marker side effects, which is exactly how you distribute reproductions without becoming the incident. Alongside that, @vitorfhc's vdet continues maturing as a "negative-day" hunter for silently patched OSS, Google's goonami-scanner is ripping out legacy binproto signatures in favor of a declarative fingerprinting engine, and the Caido ecosystem (sdk-js v0.59.1, plugin store merging Wsdler, docs for the new capture menu) shows steady extension-platform investment. Less obvious but notable: [dawgyg/AppleResearch] dumping a large corpus of unreported-below-threshold macOS findings, [assetnote/assetnote-mcp-server-public-docs] formalizing AI-to-attack-surface querying, and [renniepak/CSPBypass]'s matcher fix landing in the same window as Kettle's CSP research. Watch for noise and squatting too -- several newly created xssdoctor/* JS repos (widget-glyph-suite, badge-core-lite-v2) have no security relevance and are worth flagging as possible namespace padding.

  • Immediate inspection: xssdoctor/git-cve-2026-113408-poc and the muse-git-* fixture family -- run them against your CI clone path and any tool that ingests untrusted repositories.
  • Trend: security PoCs are being published as *safe, deterministic, network-free* fixtures with marker side effects -- adopt this pattern for your own disclosures.
  • Watch: vitorfhc/videt is the closest thing to an automated pre-CVE pipeline in this window; fork it and point it at your target stack.
  • Tooling: google/goonami-scanner's move to a declarative webidentity fingerprinter is a sign the scanner OSS ecosystem is converging on declarative, reloadable detection definitions.
  • Low-signal but worth a bookmark: renniepak/CSPBypass (scheme-relative fix) and JorianWoltjer/responder (query-param-driven header/HTML PoC builder) both directly accelerate CSP and header-injection testing.