.-.                             .-. 
(: `-----------------------------' :)
 )   intel brief // today // 24h   ( 
(: .-----------------------------. :)
 `-'                             `-' 

• CVE-2015-10149 -- Dancer session ids go straight to the engine -- Dancer <1.3400 for Perl passes the session cookie's id into the session engine with zero validation, so a crafted cookie pokes directly at whatever backing store sits behind it (YAML, DBI, whatever the app wired up). Eleven-digit CVE number on a decade-old bug class; filter those ids before they hit the engine or upgrade past 1.3400 [Source / oss-security].
• CVE-2026-128240 -- GPAC use-after-free in gf_sg_proto_del -- MP4Box through 26.07.0 frees prototype scene-graph nodes during XMT scene teardown and then keeps using them (CWE-416, CVSS 5.5, AV:L/UI:R, crash-only per the advisory). Fixed in a2e5c62c -- pull that commit and check whether 'crash-only' survives a heap-grooming pass [Source / oss-security].
• Cursor marketplace breach via stolen Fireworks AI credentials -- attackers lifted credentials from Fireworks AI and pushed a malicious Claude Code extension through Cursor's marketplace, a clean supply-chain hijack of the editor auto-fetch path. Audit what your editor silently installs; the trust boundary here was a vendor pipeline, not the user [Source / BleepingComputer].
• DPRK 'FaceStealer' disruption -- expect retooling, not retirement -- US infrastructure takedown hit the crew behind $400M+ in spoofed-identity crypto theft. Disruption ops rarely kill the playbook; the same lures and fake-recruiter personas will rotate onto fresh infra inside a month [Source / BleepingComputer].
• gVisor tightens proc-umount and child-netns loopback -- google/gvisor merged proc-umount process-handle work, host-net child netns loopback handling, and file-lock wait registration in one push. Sandbox maintainers patching descriptor and netns seams quietly usually means somebody was holding a handle across teardown -- worth a diff [google/gvisor].
• osv.dev locks Cloud Run to least-privilege and fixes RPM version ordering -- the vuln DB itself got hardened: least-privilege service account on Cloud Run, plus corrected RPM version comparisons for TuxCare/CentOS/OracleLinux/RHEL. Version-ordering bugs in a triage service mean missed or false matches feeding every downstream consumer [google/osv.dev].

 .-.                               .-. 
(: `-------------------------------' :)
 )   possibilities // today // 24h   ( 
(: .-------------------------------. :)
 `-'                               `-' 

• Heap-groom the GPAC XMT teardown UAF past 'crash-only' -- grab fix a2e5c62c, diff gf_sg_proto_del's free order, and fuzz XMT/BT scene inputs with controlled allocation churn between node deletion and reuse; sibling scene-graph code in libgpac's BIFS and VRML paths likely shares the teardown pattern [inspired by oss-security GPAC advisory].
• Poke Dancer session engines with crafted cookie ids -- enumerate Dancer::Session::YAML/DBI backends, feed path-shaped and format-shaped session ids from the cookie, and watch for traversal or deserialization in the engine layer; then sweep sibling Perl frameworks (Mojolicious, Catalyst) for the same unvalidated-id handoff [inspired by oss-security Dancer advisory].
• Audit editor extension marketplaces for auto-fetch trust gaps -- the Cursor/Fireworks chain shows a stolen vendor credential -> marketplace publish -> client auto-install path; map which marketplaces sign packages, which just gate on publisher auth, and whether pinned versions can be silently swapped post-publication [inspired by BleepingComputer Cursor breach report].
• Diff gVisor's proc-umount handle work for escape primitives -- the process-handle and child-netns loopback merges touch exactly the seams where a sandboxed process can hold references across namespace teardown; build a repro that forks, umounts /proc, and races netns creation to see if stale handles leak host context [inspired by google/gvisor].
• Hunt negative-day patches with videt's methodology -- vitorfhc/videt watches major OSS repos for silent security fixes landing before a CVE is assigned; point it at high-value targets (GPAC, ImageMagick, curl) and race the window between fix commit and advisory publication [inspired by vitorfhc/videt].
• Fuzz rtl_433's shrunk MAXIMAL_BUF_LENGTH -- the recent commits shrank the maximal buffer and reworked SDR reopen/connection-handler teardown; feed oversized or malformed ISM frames at the new boundary and hammer the mg_mgr_free() shutdown path for use-after-free on the socket handlers [inspired by merbanan/rtl_433].