. . . t h e d e a d . d o g . . .                        
                                                                                 
         .-----------..__  .-----------------------.  __..---------._ .-.        
        | .---------.    \/                         \/          .+*+. . |        
        | :   A      `--.._             .                    _..--'   : |        
        | :   .                        /:\                            : |        
        | :  /:\                     ./:::\.                          : |        
        | : (_:_)                  .:/::|::\:.                        : /        
        \ :  _|_                 .::/:::|:::\::.                      .<         
         > .                   .:::/::::|::::\:::.                    : \        
        / :                  .:::/::::--+--::::\:::.                  : |        
        | :               .:::::/:::::::|:::::::\:::::.               : |        
        | :            .::::::/\:::::::.:.:::::::/\::::::.            : |        
        | :          .:::::::/  \[0xDEAD:0xBEEF]/  \:::::::.          : |        
        | :        .::::::::/ /\ \::::..:..::::/ /\ \::::::::.        : |        
        | :       .::::::::/ /  \ \:::: : ::::/ /  \ \::::::::.       : |        
        | :      (::::::::/_ tDd _\:::'.:.`:::/_ PWN _\::::::::)      : |        
        | :     (:::::::::| ``::::''   .:.   ``::::'' |:::::::::)     : |        
        | :     (:::::::::| .:::::::..     ..:::::::. |:::::::::)     : |        
        | :     (:::::::::|:::::' [ x ]   [ x ] `:::::|:::::::::)     : |        
        | :     (:::::::::\:::::. `---'   `---' .:::::/:::::::::)     : |        
        \ :     (::::::::::\ `:::.    .:::.    .:::' /::::::::::)     : |        
         > .     \:::::::::::\__ ::. / /|\ \ .:: __/:::::::::::/      : |        
        / :       \::::::::::::| :::. \_|_/ .::: |::::::::::::/       : /        
        | :        \:::::::::::| ::::_|||||_:::: |:::::::::::/        .<         
        | :         \::::::::::/\ .:/\_/|\_/\:. /\::::::::::/         : \        
        | :           `::::::::' ``::.| | |.::'' `::::::::'           : |        
        | :              `-----' 8===8`:::'8===8 `-----'              : |        
        | :                       _\_/:::::\_/_                       : |        
        | :                      /___/:::::\___\                 `|'  : |        
        | :                     `==============='               (`:') : |        
        | :                                                      \:/  : |        
        | : .+*+.        . . :: [ t D d : A C E ] :: . .          '   : |        
        | :.. :                                                   A ..: |        
        | `---.._ `--..___..--~`\.-------------------./'~--..___..--' . |        
         `-------`~--..___       `'                 `'     ___..--~--'  '        
                                                                                 
     _______________________/  - x  live: off  x -  \_______________________     
                           /`-----------------------'\                           
      /\___/\             (: `_____________________' :)             /\___/\      
     / .:::. \           /   [ tDd // THE DEAD DOG ]   \           / .:::. \     
    /[ x   x ]\         /  .::     MMXXVI A.D.     ::.  \         /[ x   x ]\    
     \ \V_V/ /         /    LATRANDO, VULNERA INVENIO    \         \ \V_V/ /     
      `-(U)-'         (_=================================_)         `-(U)-'
tdd@wire:~$""/var/wire/news/today^C
 .-.                                  .-. 
(: `----------------------------------' :)
 )   cyber news & pods (today // 24h)   ( 
(: .----------------------------------. :)
 `-'                                  `-'
[ full news wire // all 13 entries in today // 24h ]
2026-11-15 01:02 - [txt] "Re: libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing" by oss-security (SecLists)
Second OOB read in unmaintained libdca DTS decoder: bitstream_fill_current() in bitstream.c does tmp = *(state->buffer_start++) with no end-of-buffer check, so a malformed .dts file walks the pointer off the heap.
·source·
+ raw
Posted by Osvaldo J. Filho on Nov 14 Following up on the scale-factor OOB read -- there's a second out-of-bounds read in the same decoder, in the bitstream reader. bitstream_fill_current() in bitstream.c reads a word and advances the pointer with no end-of-buffer check: static inline void bitstream_fill_current (dca_state_t * state) { uint32_t tmp; tmp = *(state->buffer_start++); /* no bounds check */ ... } The decoder state (dca_internal.h) has no buffer_end field at...
2026-11-15 00:00 - [txt] "DIVINER: Occult Synth Firmware for the Cardputer" by Hackaday
DIVINER firmware for the M5 Cardputer turns the ESP32 handheld into an 'occult' synth -- demo/novelty hardware work, not a security primitive; interesting only as an example of Cardputer firmware flashing.
·source·
+ raw
We see some strange software around these parts, but this is probably the strangest. DIVINER is a firmware for the M5 Cardputer, which is an interesting device in its own
2026-11-14 23:38 - [txt] "libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing" by oss-security (SecLists)
libdca (VideoLAN DTS decoder, abandoned, dropped from VLC 4.0) has an out-of-bounds read in scale-factor parsing reachable from a crafted DTS frame; still shipped by distros as a library, so media parsers stay a live local/RCE-ish bug class.
·source·
+ raw
Posted by Osvaldo J. Filho on Nov 14 Hi, libdca is VideoLAN's DTS Coherent Acoustics decoder. It's effectively unmaintained (VideoLAN confirmed to me it's abandoned and it was dropped from VLC 4.0), but several distros still ship it as a library, so I'm reporting here. There's an out-of-bounds read in the scale-factor parser, reachable from a crafted DTS frame. I verified it against the current tree at...
2026-11-14 20:28 - [txt] "CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine" by oss-security (SecLists)
Dancer <1.3400 for Perl hands session ids straight from the cookie to the session engine with no validation, so a crafted cookie can poke at the backing store; upgrade past 1.3400 or filter ids before they hit the engine.
·source·
+ raw
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2015-10149 CPAN Security Group ======================================================================== CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN: https://metacpan.org/dist/Dancer VCS Repo:...
2026-11-14 19:16 - [txt] "CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown" by oss-security (SecLists)
GPAC/MP4Box through 26.07.0 has a use-after-free in gf_sg_proto_del during XMT scene teardown (CWE-416, CVSS 5.5, AV:L/UI:R, crash-only); fixed in a2e5c62c.
·source·
+ raw
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: a2e5c62c213b5329a4572fe8e7c333e1ca26d028 CVE: CVE-2026-128240 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: After...
2026-11-14 19:14 - [txt] "CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input" by oss-security (SecLists)
GPAC/MP4Box type confusion in appearance handling via crafted XMT input (CWE-843, CVSS 5.5); local vector, needs a victim to open the file -- fixed in 43a8329a.
·source·
+ raw
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 43a8329a90ae2907716b593cc3746458516c7c39 CVE: CVE-2026-124031 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: During...
2026-11-14 19:12 - [txt] "CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands" by oss-security (SecLists)
GPAC/MP4Box type confusion in XMT field-replace commands (CWE-843, CVSS 5.5); parsing the wrong struct type gives an A:H crash on crafted scene graphs, fixed in 1359c4da.
·source·
+ raw
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 1359c4da9329cedceeb8fcfeab6d97e0927236e1 CVE: CVE-2026-124030 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: While...
2026-11-14 18:41 - [txt] "[vim-security] Command Execution via PowerShell Keyword Lookup in Vim < 9.2.1346" by oss-security (SecLists)
Vim <9.2.1346: PowerShell keyword lookup path lets a crafted keyword blow past shell-quoting into OS command execution (CWE-78), low severity; fix rides on GHSA-r5v6-q6j8-8qw2.
·source·
+ raw
Posted by Christian Brabandt on Nov 14 Command Execution via PowerShell Keyword Lookup in Vim < 9.2.1346 ================================================================= Date: 14.11.2026 Severity: Low CVE: *requested, not yet assigned* CWE: Improper Neutralization of Special Elements used in an OS Command (CWE-78) ## Summary The fix for [GHSA-r5v6-q6j8-8qw2]( https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2 ) in `runtime/ftplugin/ps1.vim` quotes the...
2026-11-14 18:39 - [txt] "CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached" by oss-security (SecLists)
HTTP::Session <0.43 for Perl: unfiltered session ids flow into HTTP::Session::Store::Memcached, so a poisoned id injects memcached commands against the backend.
·source·
+ raw
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2011-10042 CPAN Security Group ======================================================================== CVE ID: CVE-2011-10042 Distribution: http-session Versions: before 0.43 MetaCPAN: https://metacpan.org/dist/http-session VCS Repo: ...
2026-11-14 18:37 - [txt] "JSON-XS versions before 4.05 for Perl (7 CVEs)" by oss-security (SecLists)
JSON::XS <4.05 packs 7 CVEs: incr_parse buffers past max_size after a NUL to exhaust memory, decode_hv leaks the key of a rejected object, plus stack exhaustion via nested tags.
·source·
+ raw
Posted by Robert Rothenberg on Nov 14 CVE-2026-124536 JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse CVE-2026-124539 JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv CVE-2026-124540 JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag...
2026-11-14 17:27 - [txt] "Cursor confirms security breach led to malicious Claude Code extension" by BleepingComputer
Cursor breach: stolen credentials from Fireworks AI let attackers push a malicious Claude Code extension through Cursor's marketplace -- supply-chain hijack of the extension pipeline, audit what your editor auto-fetches.
·source·
+ raw
Cursor confirmed it suffered a security breach that let hackers distribute a malicious Claude Code extension through its marketplace after stealing credentials from AI infrastructure provider Fireworks AI.
2026-11-14 15:15 - [txt] "US disrupts North Korean campaign behind $400 million crypto theft" by BleepingComputer
'FaceStealer' -- DPRK social engineering crew that spoofed identities to siphon $400M+ in crypto; US disruption hit their infrastructure, so expect retooling and fresh lures rather than a stop.
·source·
+ raw
The U.S. government has disrupted a North Korean social engineering campaign called 'FaceStealer', responsible for stealing more than $400 million in cryptocurrency.
2026-11-14 12:00 - [txt] "Reverse Engineering Score Perfect to Rescue its Files" by Hackaday
Reverse engineering a high-score game to recover its bundled data files -- the takeaway is format archaeology on abandoned proprietary containers when bit rot and lost metadata threaten preservation, so grab raw dumps before the media dies.
·source·
+ raw
There are myriad challenges associated with data preservation – bit rot, loss of metadata, and hardware failures, among others – but one of the hardest is making sure that the
Re: libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-15 01:02 UTC
[ notes ]
Second OOB read in unmaintained libdca DTS decoder: bitstream_fill_current() in bitstream.c does `tmp = *(state->buffer_start++)` with no end-of-buffer check, so a malformed .dts file walks the pointer off the heap.
[ source excerpt ]
Posted by Osvaldo J. Filho on Nov 14 Following up on the scale-factor OOB read -- there's a second out-of-bounds read in the same decoder, in the bitstream reader. bitstream_fill_current() in bitstream.c reads a word and advances the pointer with no end-of-buffer check: static inline void bitstream_fill_current (dca_state_t * state) { uint32_t tmp; tmp = *(state->buffer_start++); /* no bounds check */ ... } The decoder state (dca_internal.h) has no buffer_end field at...
open original url ->
DIVINER: Occult Synth Firmware for the Cardputer
source: Hackaday | role: Hardware, Firmware & Reverse Engineering | published: 2026-11-15 00:00 UTC
[ notes ]
DIVINER firmware for the M5 Cardputer turns the ESP32 handheld into an 'occult' synth -- demo/novelty hardware work, not a security primitive; interesting only as an example of Cardputer firmware flashing.
[ source excerpt ]
We see some strange software around these parts, but this is probably the strangest. DIVINER is a firmware for the M5 Cardputer, which is an interesting device in its own
open original url ->
libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 23:38 UTC
[ notes ]
libdca (VideoLAN DTS decoder, abandoned, dropped from VLC 4.0) has an out-of-bounds read in scale-factor parsing reachable from a crafted DTS frame; still shipped by distros as a library, so media parsers stay a live local/RCE-ish bug class.
[ source excerpt ]
Posted by Osvaldo J. Filho on Nov 14 Hi, libdca is VideoLAN's DTS Coherent Acoustics decoder. It's effectively unmaintained (VideoLAN confirmed to me it's abandoned and it was dropped from VLC 4.0), but several distros still ship it as a library, so I'm reporting here. There's an out-of-bounds read in the scale-factor parser, reachable from a crafted DTS frame. I verified it against the current tree at...
open original url ->
CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 20:28 UTC
[ notes ]
Dancer <1.3400 for Perl hands session ids straight from the cookie to the session engine with no validation, so a crafted cookie can poke at the backing store; upgrade past 1.3400 or filter ids before they hit the engine.
[ source excerpt ]
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2015-10149 CPAN Security Group ======================================================================== CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN: https://metacpan.org/dist/Dancer VCS Repo:...
open original url ->
CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 19:16 UTC
[ notes ]
GPAC/MP4Box through 26.07.0 has a use-after-free in gf_sg_proto_del during XMT scene teardown (CWE-416, CVSS 5.5, AV:L/UI:R, crash-only); fixed in a2e5c62c.
[ source excerpt ]
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: a2e5c62c213b5329a4572fe8e7c333e1ca26d028 CVE: CVE-2026-128240 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: After...
open original url ->
CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 19:14 UTC
[ notes ]
GPAC/MP4Box type confusion in appearance handling via crafted XMT input (CWE-843, CVSS 5.5); local vector, needs a victim to open the file -- fixed in 43a8329a.
[ source excerpt ]
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 43a8329a90ae2907716b593cc3746458516c7c39 CVE: CVE-2026-124031 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: During...
open original url ->
CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 19:12 UTC
[ notes ]
GPAC/MP4Box type confusion in XMT field-replace commands (CWE-843, CVSS 5.5); parsing the wrong struct type gives an A:H crash on crafted scene graphs, fixed in 1359c4da.
[ source excerpt ]
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: 1359c4da9329cedceeb8fcfeab6d97e0927236e1 CVE: CVE-2026-124030 CWE: CWE-843 (Type Confusion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: While...
open original url ->
[vim-security] Command Execution via PowerShell Keyword Lookup in Vim < 9.2.1346
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 18:41 UTC
[ notes ]
Vim <9.2.1346: PowerShell keyword lookup path lets a crafted keyword blow past shell-quoting into OS command execution (CWE-78), low severity; fix rides on GHSA-r5v6-q6j8-8qw2.
[ source excerpt ]
Posted by Christian Brabandt on Nov 14 Command Execution via PowerShell Keyword Lookup in Vim < 9.2.1346 ================================================================= Date: 14.11.2026 Severity: Low CVE: *requested, not yet assigned* CWE: Improper Neutralization of Special Elements used in an OS Command (CWE-78) ## Summary The fix for [GHSA-r5v6-q6j8-8qw2]( https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2 ) in `runtime/ftplugin/ps1.vim` quotes the...
open original url ->
CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 18:39 UTC
[ notes ]
HTTP::Session <0.43 for Perl: unfiltered session ids flow into HTTP::Session::Store::Memcached, so a poisoned id injects memcached commands against the backend.
[ source excerpt ]
Posted by Robert Rothenberg on Nov 14 ======================================================================== CVE-2011-10042 CPAN Security Group ======================================================================== CVE ID: CVE-2011-10042 Distribution: http-session Versions: before 0.43 MetaCPAN: https://metacpan.org/dist/http-session VCS Repo: ...
open original url ->
JSON-XS versions before 4.05 for Perl (7 CVEs)
source: oss-security (SecLists) | role: Linux Kernel & Open Source CVE Disclosures | published: 2026-11-14 18:37 UTC
[ notes ]
JSON::XS <4.05 packs 7 CVEs: incr_parse buffers past max_size after a NUL to exhaust memory, decode_hv leaks the key of a rejected object, plus stack exhaustion via nested tags.
[ source excerpt ]
Posted by Robert Rothenberg on Nov 14 CVE-2026-124536 JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse CVE-2026-124539 JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv CVE-2026-124540 JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag...
open original url ->
Cursor confirms security breach led to malicious Claude Code extension
source: BleepingComputer | role: Breaking Exploits & Incident Wire | published: 2026-11-14 17:27 UTC
[ notes ]
Cursor breach: stolen credentials from Fireworks AI let attackers push a malicious Claude Code extension through Cursor's marketplace -- supply-chain hijack of the extension pipeline, audit what your editor auto-fetches.
[ source excerpt ]
Cursor confirmed it suffered a security breach that let hackers distribute a malicious Claude Code extension through its marketplace after stealing credentials from AI infrastructure provider Fireworks AI.
open original url ->
US disrupts North Korean campaign behind $400 million crypto theft
source: BleepingComputer | role: Breaking Exploits & Incident Wire | published: 2026-11-14 15:15 UTC
[ notes ]
'FaceStealer' -- DPRK social engineering crew that spoofed identities to siphon $400M+ in crypto; US disruption hit their infrastructure, so expect retooling and fresh lures rather than a stop.
[ source excerpt ]
The U.S. government has disrupted a North Korean social engineering campaign called 'FaceStealer', responsible for stealing more than $400 million in cryptocurrency.
open original url ->
Reverse Engineering Score Perfect to Rescue its Files
source: Hackaday | role: Hardware, Firmware & Reverse Engineering | published: 2026-11-14 12:00 UTC
[ notes ]
Reverse engineering a high-score game to recover its bundled data files -- the takeaway is format archaeology on abandoned proprietary containers when bit rot and lost metadata threaten preservation, so grab raw dumps before the media dies.
[ source excerpt ]
There are myriad challenges associated with data preservation – bit rot, loss of metadata, and hardware failures, among others – but one of the hardest is making sure that the
open original url ->