. . . t h e d e a d . d o g . . .                        
                                                                                 
         .-----------..__  .-----------------------.  __..---------._ .-.        
        | .---------.    \/                         \/          .+*+. . |        
        | :   A      `--.._             .                    _..--'   : |        
        | :   .                        /:\                            : |        
        | :  /:\                     ./:::\.                          : |        
        | : (_:_)                  .:/::|::\:.                        : /        
        \ :  _|_                 .::/:::|:::\::.                      .<         
         > .                   .:::/::::|::::\:::.                    : \        
        / :                  .:::/::::--+--::::\:::.                  : |        
        | :               .:::::/:::::::|:::::::\:::::.               : |        
        | :            .::::::/\:::::::.:.:::::::/\::::::.            : |        
        | :          .:::::::/  \[0xDEAD:0xBEEF]/  \:::::::.          : |        
        | :        .::::::::/ /\ \::::..:..::::/ /\ \::::::::.        : |        
        | :       .::::::::/ /  \ \:::: : ::::/ /  \ \::::::::.       : |        
        | :      (::::::::/_ tDd _\:::'.:.`:::/_ PWN _\::::::::)      : |        
        | :     (:::::::::| ``::::''   .:.   ``::::'' |:::::::::)     : |        
        | :     (:::::::::| .:::::::..     ..:::::::. |:::::::::)     : |        
        | :     (:::::::::|:::::' [ x ]   [ x ] `:::::|:::::::::)     : |        
        | :     (:::::::::\:::::. `---'   `---' .:::::/:::::::::)     : |        
        \ :     (::::::::::\ `:::.    .:::.    .:::' /::::::::::)     : |        
         > .     \:::::::::::\__ ::. / /|\ \ .:: __/:::::::::::/      : |        
        / :       \::::::::::::| :::. \_|_/ .::: |::::::::::::/       : /        
        | :        \:::::::::::| ::::_|||||_:::: |:::::::::::/        .<         
        | :         \::::::::::/\ .:/\_/|\_/\:. /\::::::::::/         : \        
        | :           `::::::::' ``::.| | |.::'' `::::::::'           : |        
        | :              `-----' 8===8`:::'8===8 `-----'              : |        
        | :                       _\_/:::::\_/_                       : |        
        | :                      /___/:::::\___\                 `|'  : |        
        | :                     `==============='               (`:') : |        
        | :                                                      \:/  : |        
        | : .+*+.        . . :: [ t D d : A C E ] :: . .          '   : |        
        | :.. :                                                   A ..: |        
        | `---.._ `--..___..--~`\.-------------------./'~--..___..--' . |        
         `-------`~--..___       `'                 `'     ___..--~--'  '        
                                                                                 
     _______________________/  - x  live: off  x -  \_______________________     
                           /`-----------------------'\                           
      /\___/\             (: `_____________________' :)             /\___/\      
     / .:::. \           /   [ tDd // THE DEAD DOG ]   \           / .:::. \     
    /[ x   x ]\         /  .::     MMXXVI A.D.     ::.  \         /[ x   x ]\    
     \ \V_V/ /         /    LATRANDO, VULNERA INVENIO    \         \ \V_V/ /     
      `-(U)-'         (_=================================_)         `-(U)-'
tdd@wire:~$""/var/wire/news/today^C
 .-.                                  .-. 
(: `----------------------------------' :)
 )   cyber news & pods (today // 24h)   ( 
(: .----------------------------------. :)
 `-'                                  `-'
[ top 10 most noteworthy of 13 entries in today // 24h ]
2026-11-14 19:16 - [txt] "CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown" by oss-security (SecLists)
GPAC/MP4Box through 26.07.0 has a use-after-free in gf_sg_proto_del during XMT scene teardown (CWE-416, CVSS 5.5, AV:L/UI:R, crash-only); fixed in a2e5c62c.
·source·
+ raw
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: a2e5c62c213b5329a4572fe8e7c333e1ca26d028 CVE: CVE-2026-128240 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: After...
2026-11-14 19:14 - [txt] "CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input" by oss-security (SecLists)
GPAC/MP4Box type confusion in appearance handling via crafted XMT input (CWE-843, CVSS 5.5); local vector, needs a victim to open the file -- fixed in 43a8329a.
·source·
+ raw
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 43a8329a90ae2907716b593cc3746458516c7c39 CVE: CVE-2026-124031 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: During...
2026-11-14 17:27 - [txt] "Cursor confirms security breach led to malicious Claude Code extension" by BleepingComputer
Cursor breach: stolen credentials from Fireworks AI let attackers push a malicious Claude Code extension through Cursor's marketplace -- supply-chain hijack of the extension pipeline, audit what your editor auto-fetches.
·source·
+ raw
Cursor confirmed it suffered a security breach that let hackers distribute a malicious Claude Code extension through its marketplace after stealing credentials from AI infrastructure provider Fireworks AI.
2026-11-14 19:12 - [txt] "CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands" by oss-security (SecLists)
GPAC/MP4Box type confusion in XMT field-replace commands (CWE-843, CVSS 5.5); parsing the wrong struct type gives an A:H crash on crafted scene graphs, fixed in 1359c4da.
·source·
+ raw
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 1359c4da9329cedceeb8fcfeab6d97e0927236e1 CVE: CVE-2026-124030 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: While...
2026-11-14 12:00 - [txt] "Reverse Engineering Score Perfect to Rescue its Files" by Hackaday
Reverse engineering a high-score game to recover its bundled data files -- the takeaway is format archaeology on abandoned proprietary containers when bit rot and lost metadata threaten preservation, so grab raw dumps before the media dies.
·source·
+ raw
There are myriad challenges associated with data preservation – bit rot, loss of metadata, and hardware failures, among others – but one of the hardest is making sure that the
2026-11-14 15:15 - [txt] "US disrupts North Korean campaign behind $400 million crypto theft" by BleepingComputer
'FaceStealer' -- DPRK social engineering crew that spoofed identities to siphon $400M+ in crypto; US disruption hit their infrastructure, so expect retooling and fresh lures rather than a stop.
·source·
+ raw
The U.S. government has disrupted a North Korean social engineering campaign called 'FaceStealer', responsible for stealing more than $400 million in cryptocurrency.
2026-11-14 20:28 - [txt] "CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine" by oss-security (SecLists)
Dancer <1.3400 for Perl hands session ids straight from the cookie to the session engine with no validation, so a crafted cookie can poke at the backing store; upgrade past 1.3400 or filter ids before they hit the engine.
·source·
+ raw
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2015-10149 CPAN Security Group ======================================================================== CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN: https://metacpan.org/dist/Dancer VCS Repo:...
2026-11-14 18:39 - [txt] "CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached" by oss-security (SecLists)
HTTP::Session <0.43 for Perl: unfiltered session ids flow into HTTP::Session::Store::Memcached, so a poisoned id injects memcached commands against the backend.
·source·
+ raw
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2011-10042 CPAN Security Group ======================================================================== CVE ID: CVE-2011-10042 Distribution: http-session Versions: before 0.43 MetaCPAN: https://metacpan.org/dist/http-session VCS Repo: ...
2026-11-14 18:37 - [txt] "JSON-XS versions before 4.05 for Perl (7 CVEs)" by oss-security (SecLists)
JSON::XS <4.05 packs 7 CVEs: incr_parse buffers past max_size after a NUL to exhaust memory, decode_hv leaks the key of a rejected object, plus stack exhaustion via nested tags.
·source·
+ raw
Posted by Robert Rothenberg on Nov 14 CVE-2026-124536 JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse CVE-2026-124539 JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv CVE-2026-124540 JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag...
2026-11-15 00:00 - [txt] "DIVINER: Occult Synth Firmware for the Cardputer" by Hackaday
DIVINER firmware for the M5 Cardputer turns the ESP32 handheld into an 'occult' synth -- demo/novelty hardware work, not a security primitive; interesting only as an example of Cardputer firmware flashing.
·source·
+ raw
We see some strange software around these parts, but this is probably the strangest. DIVINER is a firmware for the M5 Cardputer, which is an interesting device in its own
CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 19:16 UTC
[ notes ]
GPAC/MP4Box through 26.07.0 has a use-after-free in gf_sg_proto_del during XMT scene teardown (CWE-416, CVSS 5.5, AV:L/UI:R, crash-only); fixed in a2e5c62c.
[ source excerpt ]
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: a2e5c62c213b5329a4572fe8e7c333e1ca26d028 CVE: CVE-2026-128240 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: After...
open original url ->
CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 19:14 UTC
[ notes ]
GPAC/MP4Box type confusion in appearance handling via crafted XMT input (CWE-843, CVSS 5.5); local vector, needs a victim to open the file -- fixed in 43a8329a.
[ source excerpt ]
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 43a8329a90ae2907716b593cc3746458516c7c39 CVE: CVE-2026-124031 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: During...
open original url ->
Cursor confirms security breach led to malicious Claude Code extension
source: BleepingComputer | role: Breaking Exploits & Incident Wire | published: 2026-11-14 17:27 UTC
[ notes ]
Cursor breach: stolen credentials from Fireworks AI let attackers push a malicious Claude Code extension through Cursor's marketplace -- supply-chain hijack of the extension pipeline, audit what your editor auto-fetches.
[ source excerpt ]
Cursor confirmed it suffered a security breach that let hackers distribute a malicious Claude Code extension through its marketplace after stealing credentials from AI infrastructure provider Fireworks AI.
open original url ->
CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 19:12 UTC
[ notes ]
GPAC/MP4Box type confusion in XMT field-replace commands (CWE-843, CVSS 5.5); parsing the wrong struct type gives an A:H crash on crafted scene graphs, fixed in 1359c4da.
[ source excerpt ]
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 1359c4da9329cedceeb8fcfeab6d97e0927236e1 CVE: CVE-2026-124030 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: While...
open original url ->
Reverse Engineering Score Perfect to Rescue its Files
source: Hackaday | role: Hardware, Firmware & Reverse Engineering | published: 2026-11-14 12:00 UTC
[ notes ]
Reverse engineering a high-score game to recover its bundled data files -- the takeaway is format archaeology on abandoned proprietary containers when bit rot and lost metadata threaten preservation, so grab raw dumps before the media dies.
[ source excerpt ]
There are myriad challenges associated with data preservation – bit rot, loss of metadata, and hardware failures, among others – but one of the hardest is making sure that the
open original url ->
US disrupts North Korean campaign behind $400 million crypto theft
source: BleepingComputer | role: Breaking Exploits & Incident Wire | published: 2026-11-14 15:15 UTC
[ notes ]
'FaceStealer' -- DPRK social engineering crew that spoofed identities to siphon $400M+ in crypto; US disruption hit their infrastructure, so expect retooling and fresh lures rather than a stop.
[ source excerpt ]
The U.S. government has disrupted a North Korean social engineering campaign called 'FaceStealer', responsible for stealing more than $400 million in cryptocurrency.
open original url ->
CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 20:28 UTC
[ notes ]
Dancer <1.3400 for Perl hands session ids straight from the cookie to the session engine with no validation, so a crafted cookie can poke at the backing store; upgrade past 1.3400 or filter ids before they hit the engine.
[ source excerpt ]
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2015-10149 CPAN Security Group ======================================================================== CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN: https://metacpan.org/dist/Dancer VCS Repo:...
open original url ->
CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 18:39 UTC
[ notes ]
HTTP::Session <0.43 for Perl: unfiltered session ids flow into HTTP::Session::Store::Memcached, so a poisoned id injects memcached commands against the backend.
[ source excerpt ]
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2011-10042 CPAN Security Group ======================================================================== CVE ID: CVE-2011-10042 Distribution: http-session Versions: before 0.43 MetaCPAN: https://metacpan.org/dist/http-session VCS Repo: ...
open original url ->
JSON-XS versions before 4.05 for Perl (7 CVEs)
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 18:37 UTC
[ notes ]
JSON::XS <4.05 packs 7 CVEs: incr_parse buffers past max_size after a NUL to exhaust memory, decode_hv leaks the key of a rejected object, plus stack exhaustion via nested tags.
[ source excerpt ]
Posted by Robert Rothenberg on Nov 14 CVE-2026-124536 JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse CVE-2026-124539 JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv CVE-2026-124540 JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag...
open original url ->
DIVINER: Occult Synth Firmware for the Cardputer
source: Hackaday | role: Hardware, Firmware & Reverse Engineering | published: 2026-11-15 00:00 UTC
[ notes ]
DIVINER firmware for the M5 Cardputer turns the ESP32 handheld into an 'occult' synth -- demo/novelty hardware work, not a security primitive; interesting only as an example of Cardputer firmware flashing.
[ source excerpt ]
We see some strange software around these parts, but this is probably the strangest. DIVINER is a firmware for the M5 Cardputer, which is an interesting device in its own
open original url ->