Pre-Auth Races, Poisoned Caches, and 31-Bit Secrets: The Month the Floor Fell Out From Under the Stack

PHP's engine room caught fire first. PHP2Shell -- CVE-2026-109618 and CVE-2026-109619, two pre-auth memory-corruption bugs in the core interpreter with working exploits and a Heartbleed-style disclosure primitive riding shotgun -- put roughly 70 percent of the web in scope, and Praetorian's field check is the one to trust: exploitable but conditional, most circulating PoCs broken, so confirm against your own build before believing a scanner hit (Praetorian). The same stretch saw Apache ship a critical fix for CVE-2026-119618, a race in mod_http2 that corrupts heap memory during h2 request handling -- unauthenticated RCE territory, with Wiz pegging 64 percent of cloud environments on vulnerable httpd (Wiz Research). Datadog's Node2Shell reproduction of CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled into Node.js and other runtimes, proves the decompressor you never chose is now your attack surface (Datadog Security Labs). WordPress core took its turn with CVE-2026-119977, an unauthenticated race in the core upgrade window spanning 4.7 through 7.1.3 and fixed in 7.1.4 -- probes hit within days of release [Wordfence]. Four engines, one primitive: win the race, own the process.

Apache Shiro turned authentication into a cache-invalidation problem. CVE-2026-129349 is the headline: with authentication caching enabled in DefaultLdapRealm, one successful login poisons the cache so any later password for that user authenticates -- CVSS 9.1, textbook (oss-security). The siblings are just as ugly: CVE-2026-129347 treats an empty stored credential as matching an empty submitted password, CVE-2026-74763 silently skips authorization annotations depending on where they sit in Guice/AspectJ/CDI/Jakarta EE hierarchies, and CVE-2026-114737 is an incomplete fix for CVE-2026-23903 where a manually-built ShiroFilterFactoryBean still defaulted to case-sensitive path matching, letting /Admin/ slip the filter chain to static files. Perimeter gear fared no better: watchTowr walked away with pre-auth remote root on Barracuda Email Security Gateway via CVE-2026-116606 and CVE-2026-111560 (watchTowr Labs), N-able's N-central '4EverAble2Shell' zero-day was exploited within hours of PoC release with 19 of 21 popped hosts on the latest update (the patch looks bypassable -- treat as live RCE), GPUStack's CVE-2026-102895 trivial auth bypass is already drawing scan traffic per ISC honeypots, and Check Point gateways rooted since late October via a zero-day got chained straight into ESXi hosts to drop a hypervisor wiper. Trust the cache, lose the keys.

The supply chain took hits at every link. Cursor confirmed that stolen credentials from an upstream provider let attackers push a malicious extension straight through its marketplace -- audit whatever your editor auto-fetches (BleepingComputer). LiteLLM 1.107.0 landed on PyPI and in container registries carrying a credential stealer plus a dormant C2 beacon, the fallout of maintainer account takeover -- pin versions and audit pulled images (Wiz Research). The wfx-loot crew ran 4,837 hijacked GitHub accounts across 61,764 repos, opening pull requests that push credential-stealing commits; Gheist auto-planted secret-dumping workflows with stolen tokens until GitHub hardening disrupted it -- same lesson twice, audit workflow write paths and token scope. SCKit worms ScreenConnect RMM sessions from client endpoints up into MSP technician boxes, weaponizing the trusted remote-support channel as the lateral pivot. And hardware joined the party: Trezor confirmed Safe 5 units from reseller CryptoBilis carried board implants exfiltrating seed phrases over cellular. Buy direct, or open the case and diff the board against a known-good unit.

Entropy failures spiced the month with pure comedy, minus the laughing. Open WebUI's start_windows.bat mints WEBUI_SECRET_KEY from libc rand() seeded with the install second -- the entire secret space of a session-signing key is a timestamp, recoverable from your own token, and the CVE attempt (CVE-2025-15603) was rejected anyway. InfiniteWP Client's NOSSL branch keys auth off a 31-bit signing secret, brute-forced live in 291.9 seconds, and the weak selection is permanent even on RSA-capable hosts (Full Disclosure). Home Assistant 2026.11.0 stores token secrets in cleartext, ships two token classes that never expire, and a password change revokes none of them -- 'your password is the key to your home' PR spin, dead on arrival against a live install. Filippo Valsorda's NIST seed bounty paid out: the P-curve seeds are drand48() output seeded with 1997-98 timestamps, deterministic and time-guessable, so verify rather than trust the ritual (Filippo Valsorda). Risky Business #856 flagged eight compromised CA private keys carrying all of 8 bits of entropy, and Trail of Bits' post-Binance takeaway lands hard: audit what your signing systems can approve, because monitoring transfers misses authority shifts until the assets move.

The parser bug class keeps paying because nobody retires anything. libdca -- abandoned, dropped from VLC 4.0, still shipped by distros -- took a second out-of-bounds read: bitstream_fill_current() in bitstream.c does tmp = *(state->buffer_start++) with no end-of-buffer check, so a crafted .dts frame walks the pointer clean off the heap. GPAC/MP4Box shipped a triple: use-after-free in gf_sg_proto_del during XMT scene teardown plus type confusions in appearance handling and field-replace commands. MongoDB's CVE-2026-118383 is an unauth-reachable use-after-free in the primary catch-up path, and Vim <9.2.1346 lets a crafted keyword blow past PowerShell quoting into OS command execution. CVE-2026-98432 deserves respect as the rare pre-auth remote Linux kernel bug -- no local foothold needed. On tradecraft, Orange Tsai's Pwn2Own Berlin Edge full chain is logic bugs only -- flawed origin and privilege checks, zero heap grooming -- which dies by fixing checks, not by hardening allocators (Orange Tsai). James Kettle keeps torching the trust perimeter: CSP allowlists become credential-exfil pipes the moment an allowlisted host serves JSONP, uploads, or open redirects (PortSwigger), six of eight popular SVG sanitizers fell to response-header-triggered JavaScript in Firefox, and plain HTTP header injection escalates to CRLF-powered desync in a single step. Meanwhile Oracle PeopleSoft's CVE-2026-35273 SSRF -> RCE is under mass exploitation by ShinyHunters, and ZDI says three distinct bugs were patched under that one CVE -- diff before you trust the count.

Machine-speed intrusion is no longer a slide deck. The FBI flash on Artex says the open-source framework automates recon -> exploit chaining, cutting initial targeting to privileged access in under three hours; Datadog caught it live in AWS hunting CloudWatch logs with stolen access keys and abusing public Cognito user pools, and Wiz tracks a Storm-0940-overlapping crew running the same playbooks against Okta and Entra. Qubole's own AWS credentials were abused to AssumeRole into customer environments through overly permissive trust policies -- hunt CloudTrail for AssumeRole from foreign account IDs. Risky Business #859 calls the whole picture: a breachpocalypse burning through global IR capacity where patch-and-response throughput is the bottleneck, and #858's Binance post-mortem -- $6.3 billion cleared by clunky tradecraft that simply worked -- confirms sloppy chains still empty exchanges. Project Zero just reworked its 90+30 disclosure policy on exactly this logic: when discovery runs at machine speed, the patch window collapses and vendors ship fast or get burned (Project Zero). Bench work for your weekend: diff Shiro 3.0.1 -> 3.0.2 for the annotation-enforcement and path-matching fixes, grep every GitHub workflow for untrusted checkout sitting next to secret-bearing steps, and measure the real entropy of anything your installers mint at setup -- this month proved the floor under the stack is a timestamp.