.-.                                .-. 
(: `--------------------------------' :)
 )   intel brief // this week // 7d   ( 
(: .--------------------------------. :)
 `-'                                `-' 

• CVE-2026-119618 mod_http2 race -- Apache shipped a critical race in mod_http2 on Nov 11; Praetorian walks what's actually known versus what vendors are whispering about RCE reachability. Wordfence is already telling WordPress owners to 'confirm their host applied the fix' -- meaning half the shared-hosting world is flying blind [Praetorian].
• CVE-2026-118383 MongoDB UAF -- use-after-free in the primary catch-up process that an *unauthenticated* client can set up. Datadog reproduced it end-to-end and gives detection angles; unauth + replication internals is the worst possible pairing [Datadog Security Labs].
• CVE-2026-128240 GPAC gf_sg_proto_del UAF -- MP4Box through 26.07.0 frees prototype scene-graph nodes during XMT teardown then keeps using them (CWE-416, AV:L/UI:R, crash-only per the advisory). Fixed in a2e5c62c; classic media-fuzzing fodder, and 'crash-only' advisories have a way of growing teeth later [oss-security].
• Blind trust: CSP as credential exfil pipe -- @albinowax shows an allowlisted domain hosting JSONP, uploads, or open redirects turns your CSP right back into a token-theft channel. Vendors pitch CSP as a seatbelt; on most prod targets it's a pre-approved exfil list [James Kettle / PortSwigger].
• Proofpoint ITM root via crafted filename -- standard Mac user -> root by dropping a file with a crafted name into a OneDrive-managed folder; the File Activity Monitor builds shell commands from filenames without quoting. Endpoint 'security' agents building shell strings from user-controlled names, again [Bishop Fox].
• Cursor breach -> malicious Claude Code extension -- stolen Fireworks AI credentials let attackers push a poisoned extension through Cursor's marketplace. Full supply-chain hijack of the editor pipeline; audit what your IDE auto-fetches before it audits you [BleepingComputer].
• CVE-2015-10149 Dancer session ids -- Dancer <1.3400 for Perl hands the session cookie's id straight to the session engine with zero validation, so a crafted cookie pokes directly at whatever backing store (YAML, DBI) sits behind it. Decade-old bug class, fresh eleven-digit number [oss-security].

 .-.                                  .-. 
(: `----------------------------------' :)
 )   possibilities // this week // 7d   ( 
(: .----------------------------------. :)
 `-'                                  `-' 

• Fuzz sibling HTTP/2 teardown paths for the mod_http2 twin -- grab the Apache fix commit, diff the stream-activation and worker-pool teardown ordering against nghttp2 and h2o's connection handling, and hammer interleaved RST_STREAM/GOAWAY under thread contention to see who else shares the race [inspired by Praetorian].
• Hunt pre-CVE silent patches with videt -- point the negative-day detector at high-value targets (gVisor, MongoDB, Apache) and race the advisory window; the gVisor device-cgroup + filestore-cleanup pushes (heads e45d53c7, ab5f509c) landed with no bulletin, which is exactly the signal class this tool exists for [inspired by vitorfhc/videt].
• Chain CSPBypass gadget corpus against Kettle's blind-trust flow -- take renniepak/CSPBypass's matcher (freshly fixed for scheme-relative and multi-directive policies), enumerate allowlisted hosts serving JSONP/uploads/redirects on your bounty targets, and wire the credential-relay chain end to end [inspired by PortSwigger + renniepak/CSPBypass].
• Sweep Perl session engines for the Dancer id-injection class -- diff Dancer 1.3400's validation fix, then grep Dancer2, Mojolicious, and Catalyst session backends for the same unvalidated cookie-id -> engine passthrough; YAML-backed stores are the juiciest (id-as-filename means path traversal) [inspired by oss-security].
• Mine dawgyg/AppleResearch for portable macOS primitives -- raw C dump of unreported macOS findings that missed bounty thresholds; triage the IOKit/XNU-adjacent ones for portability to iOS and visionOS siblings, since Apple rarely fixes what nobody filed [inspired by dawgyg].
• Replay the GPAC XMT teardown UAF with heap grooming -- the advisory says crash-only, but gf_sg_proto_del frees prototype nodes mid-parse; build an XMT corpus that interleaves prototype instantiation with parse errors and see if the freed node lands adjacent to attacker-controlled scene data [inspired by oss-security].
• Audit extension marketplaces for the Cursor credential path -- map which marketplaces (VS Code, JetBrains, Cursor) trust publisher tokens from third-party inference providers, then test whether a rotated-but-stale token still signs a publish -- that's the exact seam the Fireworks AI theft abused [inspired by BleepingComputer].