.-. .-. (: `-----------------------------' :) ) intel brief // today // 24h ( (: .-----------------------------. :) `-' `-'
- xssdoctor's muse dependency-lifecycle parent/leaf pair -- parent package ships zero pre/install/postinstall hooks but pins a researcher-owned dep at a fixed commit; the leaf's postinstall writes a marker file only inside its own dir -- no network, no subprocess, no symlink. Clean oracle for whether a package installer still executes transitive lifecycle scripts. Textbook inert harness [Source / @xssdoctor].
- google/gvisor -- merges add proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration. Sandbox kernel maintainers tightening handle lifetime and lock teardown without a bulletin -- assume somebody found a way to hold a descriptor across teardown [Source / google/gvisor].
- google/osv.dev -- commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling. RPM ordering bugs in a vuln DB mean wrong severity triage for entire distro families; the SA tightening smells like someone poked at over-privileged Run identity [Source / google/osv.dev].
- google/cybernetic-agent-governance-engine -- CAGE gates tool calls, spend, and actuation through a deterministic policy pipeline and writes signed tamper-evident receipts either way. A control plane is only as strong as its policy parser; the receipt chain is a nice auditable choke point for post-hoc tracing [Source / google].
- JorianWoltjer/responder -- query-param PoC server bakes custom response headers into the URL for shareable header-gated XSS proof; new commits add nested autocomplete in SVG/XML plus a small-screen scroll fix. Grab it for CSP/X-Content-Type-Option bypass demos [Source / @JorianWoltjer].
- vitorfhc/videt -- watches major OSS repos for silent security patches landing before a CVE is assigned, then checks reachability/exploitability. Negative-day hunting as a service; exactly the window where gVisor-style quiet fixes live [Source / @vitorfhc].
- google/go-cloud -- fixes stop a slow pubsub ReceiveBatch from stalling Receive, create missing memdocstore parents on Update, and close gcsblob readers when BeforeRead fails. The gcsblob reader leak on BeforeRead failure is a classic descriptor-hold pattern worth a second look [Source / google/go-cloud].
.-. .-. (: `-------------------------------' :) ) possibilities // today // 24h ( (: .-------------------------------. :) `-' `-'
- Audit CAGE's policy pipeline for bypass -- diff the deterministic policy evaluation order against the receipt-signing path; look for TOCTOU between policy check and actuation, and whether a tool call can mutate spend state mid-pipeline. Signed receipts don't help if the decision input was already raced [inspired by google/cybernetic-agent-governance-engine].
- Hunt gVisor proc-umount handle escapes -- pull the proc-umount process-handle and file-lock wait registration commits, grep for sibling paths in runsc that keep procfs handles open across umount, and hammer teardown order under thread contention [inspired by google/gvisor].
- Chain the lifecycle-probe pattern against other installers -- clone the parent/leaf marker-file pattern and point it at npm, pnpm, yarn, and pip resolvers to map which ones still execute transitive postinstall from a pinned-commit dep; diff results per lockfile format [inspired by @xssdoctor].
- Exploit RPM version-ordering gaps in triage tools -- the TuxCare/CentOS/OracleLinux/RHEL ordering fix implies prior mis-ranking; feed crafted epoch/release strings at any downstream consumer of OSV data and check for severity downgrades [inspired by google/osv.dev].
- Probe go-cloud blob reader leaks -- the BeforeRead gcsblob reader-close fix hints at a descriptor-hold pattern; grep the s3blob and azureblob siblings for the same unclosed-reader path on error returns [inspired by google/go-cloud].
- Fuzz j2cl cast-removal semantics -- redundant-cast removal for intersection and null-literal casts just got fixed; feed malformed generics through the transpiler and diff generated Closure JS semantics against javac behavior -- compiler miscompiles are quiet XSS/type-confusion factories [inspired by google/j2cl].
- Run videt against tonight's quiet commits -- point it at gVisor, tcmalloc, and go-cloud push streams from this window; the negative-day gap between silent fix and CVE assignment is where the real bugs surface first [inspired by vitorfhc/videt].
.-. .-. (: `------------------------------' :) ) github brief // today // 24h ( (: .------------------------------. :) `-' `-'
Dead air on the blogs and tweets, so the whole wire tonight is git pushes and fresh scaffolds. Two threads dominated: xssdoctor carpet-bombed the muse-* namespace with a dozen same-day repos -- mostly inert bun-built static pages, but two of them (the dependency-lifecycle parent/leaf pair) are a live supply-chain probe with a detectable marker payload -- and Google's low-level maintainers quietly tightened sandbox handles, vuln-DB permissions, and allocator trees with zero fanfare. No conferenceware, no vendor spin. Just diff fodder.
- xssdoctor/muse-dependency-lifecycle-parent-20261114 -- parent JS package with no lifecycle hooks of its own but a pinned researcher-owned dependency; the whole point is testing whether the installer executes transitive lifecycle code anyway. Worth a 10-minute diff against your own lockfiles.
- xssdoctor/muse-dependency-lifecycle-leaf-20261114 -- the leaf's postinstall writes one fixed marker file inside its own package dir -- no network, no subprocess, no symlink, no outside writes. Clean, inert payload proving script execution. No network, no payload, clean oracle.
- xssdoctor/muse-tarball-ua-parent-20261114 -- 'package provenance' baseline: bun install -> build -> scripts-free static HTML. Pristine reference for diffing tarball or dependency tampering against a known-clean page.
- xssdoctor/muse-toctou-parent-20261114 -- 'dependency snapshot control' reference build, same bun-to-static pattern. Baseline for spotting TOCTOU or snapshot drift between install and postinstall steps.
- vitorfhc/videt -- negative-day watcher: flags silent security patches in major OSS repos before a CVE lands, then checks actual reachability. Point it at tonight's gVisor and go-cloud merges and see what it flags by morning.
EOF // /var/briefs/today