.-.                                  .-. 
(: `----------------------------------' :)
 )   intel brief // this month // 30d   ( 
(: .----------------------------------. :)
 `-'                                  `-' 

• Barracuda ESG pre-auth remote root -- watchTowr chains CVE-2026-116606 and CVE-2026-111560 into pre-auth remote root on the Email Security Gateway. Full writeup with the chain mechanics, so every unpatched appliance on the internet is now a countdown timer [Source / watchTowr Labs].
• CVE-2026-119618 mod_http2 race -- critical race condition in Apache's HTTP/2 module, disclosed Nov 11, with RCE potential per the follow-on PSA. Race bugs in stream handling are exactly where desync-to-heap primitives get born; diff the fix commit before someone else does [Source / Praetorian].
• CVE-2026-118383 MongoDB UAF -- unauthenticated clients can set up the primary catch-up process that then trips a use-after-free in MongoDB Server. Full reproduction writeup, which means the exploit path is documented end to end [Source / Datadog Security Labs].
• CSP allowlists as credential exfil pipes -- @albinowax shows an allowlisted host serving JSONP, uploads, or open redirects turns blocked XSS right back into token theft. Vendors still pitch CSP like a magic seatbelt; on most prod targets it's a pre-approved exfil list [Source / James Kettle].
• CVE-2026-128240 GPAC use-after-free -- MP4Box through 26.07.0 frees prototype scene-graph nodes in gf_sg_proto_del during XMT scene teardown and keeps using them (CWE-416, crash-only per the advisory, fixed in a2e5c62c). 'Crash-only' advisories on media parsers have a long history of graduating to code execution [Source / oss-security].
• Cursor marketplace supply-chain hijack -- stolen Fireworks AI credentials let attackers push a malicious Claude Code extension through Cursor's marketplace. Audit what your editor auto-fetches tonight, not next quarter [Source / BleepingComputer].
• Proofpoint ITM root via crafted filename -- a standard Mac user gets root by dropping a file with a crafted name in a OneDrive-managed folder, because the File Activity Monitor builds shell commands from filenames. Classic quoting bug, textbook impact [Source / Bishop Fox].

 .-.                                    .-. 
(: `------------------------------------' :)
 )   possibilities // this month // 30d   ( 
(: .------------------------------------. :)
 `-'                                    `-' 

• Diff the mod_http2 fix for sibling stream races -- pull the Apache httpd fix commit, map which stream-state transitions lost their lock, then grep mod_proxy_http2 and h2 workers for the same unlocked teardown order under concurrent RST_STREAM. Race fixes rarely land alone [inspired by Praetorian].
• Hunt GPAC's scene-graph teardown twins -- gf_sg_proto_del frees prototype nodes during XMT teardown; fuzz the same teardown path via BT and SVG scene imports, and check whether the LASeR codec path shares the node-lifetime bug. Fixed in a2e5c62c -- diff it against every other gf_sg_*_del caller [inspired by oss-security].
• Turn CSP allowlists into your exfil menu -- enumerate script-src hosts on your target, fingerprint each for JSONP callbacks, upload endpoints, and open redirects, then chain any gadget into credential theft. Pair with renniepak/CSPBypass for the matcher work [inspired by James Kettle].
• Replay the MongoDB catch-up UAF against replica sets -- the unauthenticated setup path into the primary catch-up process is the interesting part; check whether older server branches and mongos routers expose the same initialization race [inspired by Datadog Security Labs].
• Audit editor extension pipelines like Cursor's -- map every marketplace your team auto-fetches from (VS Code, Cursor, JetBrains), check for publisher-verification gaps, and test whether a stolen publisher token is all it takes to push an update. That's the whole chain [inspired by BleepingComputer].
• Sweep macOS endpoint agents for filename-to-shell bugs -- the Proofpoint File Activity Monitor builds shell commands from filenames; grep other DLP/EDR agents for popen/system calls fed by filesystem event names, then drop crafted filenames in cloud-sync folders. Sibling agents almost certainly share the pattern [inspired by Bishop Fox].
• Mine the unreported macOS corpus for portable bugs -- a raw C dump of macOS findings that fell under bounty thresholds; triage the memory-corruption entries, then check whether the same code paths exist in iOS and visionOS frameworks [inspired by dawgyg].