Poisoned Auth Caches, 31-Bit Secrets, and the Week the Patch Window Collapsed

Apache's mod_http2 handed the wire its loudest bang of the week: CVE-2026-119618, a race condition in HTTP/2 request handling that corrupts heap memory on unauthenticated connections, with Praetorian flagging credible remote code execution potential and Wiz counting vulnerable httpd resources in 64 percent of cloud environments they scanned. Wordfence pushed a PSA telling WordPress owners to stop assuming their shared host handled it. The backdrop makes it worse: SANS tallied 1,260 CVEs in November's Patch Tuesday, 68 of them critical, plus 167 Chromium flaws riding into Edge, and ZDI's review is pure triage material at that volume. When the queue is four digits deep, patch-lag itself becomes the exploit primitive -- attackers don't need a zero-day, they need your ticket to sit in the queue for a fortnight.

Edge appliances took live fire all week. Check Point shipped emergency hotfixes for a zero-day exploited since late October for root and persistence on Security Gateways, and the same gateway fleet is being popped via PHP2Shell and chained into VMware ESXi wiper deployments -- patch the gateway, then audit the hypervisor for implanted accounts and datastore damage. N-able's N-central got hit with '4EverAble2Shell' within hours of a PoC dropping, and here's the ugly part: 19 of 21 compromised hosts were on the latest update, so the shipped fix looks bypassable -- treat it as an open RCE, not a closed ticket. SANS honeypots also caught crews scanning for existing SAP NetWeaver webshells by known paths, essentially inventorying other attackers' footholds, while XBOW and Onapsis pulled 14 fresh SAP bugs out of 7 notes including a CVSS 9.9. Bishop Fox rounded it out with Proofpoint ITM on macOS, where the File Activity Monitor builds shell commands from filenames in a OneDrive-managed folder -- standard user to root via a crafted filename. Twenty years of RFCs and still broken.

The Apache Shiro cluster deserves its own autopsy, because it's a masterclass in an auth framework failing at every seam between cache, matcher, and filter chain. The headliner is CVE-2026-129349: with authentication caching enabled, DefaultLdapRealm lets one successful login poison the cache so any later password for that user authenticates -- CVSS 9.1, hit 3.0.1. CVE-2026-129347 makes DefaultPasswordService and SimpleCredentialsMatcher treat an empty stored credential as matching an empty submitted password, an empty-hash bypass. CVE-2026-129348 is quieter but nastier as a persistence primitive: PropertiesRealm reload never purges deleted users or narrowed permissions, so revoked grants survive a config refresh. RememberMe hands attackers session fixation via CVE-2026-74762, and CVE-2026-74763 means authorization annotations are silently unenforced depending on where they sit in the class hierarchy across Guice, AspectJ, CDI, and Jakarta EE integrations. Best of the lot: CVE-2026-114737 is an incomplete fix for CVE-2026-23903, where a manually-built ShiroFilterFactoryBean still defaulted to case-sensitive path matching, so a plain /Admin/ slipped the filter chain -- shiro-spring 3.0.1 -> 3.0.2. 'Fixed' apparently meant 'fixed the config we test with.'

The supply chain took hits at every layer. Cursor confirmed a breach where stolen credentials from an upstream vendor let attackers push a malicious extension through the marketplace pipeline -- audit what your editor auto-fetches, because nobody reviews that trust path. The 'wfx-loot' crew hijacked 4,837 GitHub accounts to probe 61,764 repos, opening pull requests and pushing credential-stealing commits -- poisoned PRs as the delivery primitive, your own CI as the loader. SCKit spreads worm-like through ScreenConnect, riding RMM sessions from client endpoints up into MSP technician boxes, which is a supply-chain pivot through the exact tooling MSPs trust most. And Trezor confirmed hardware implants in Safe 5 units sold through reseller CryptoBilis, exfiltrating seed phrases over cellular -- the fix is buying direct or opening the case and diffing the board against a known-good unit. Code supply chain, trust supply chain, solder supply chain: same bug, different soldering iron.

Meanwhile the secret-material stories read like a 1990s time capsule. InfiniteWP Client 1.13.10's NOSSL auth branch keys off a single request param with a 31-bit signing secret, brute-forced live in 291.9 seconds -- and once stored, the weak selection is permanent even on RSA-capable hosts. Open WebUI's start_windows.bat mints WEBUI_SECRET_KEY from libc rand() seeded with the install second, so the entire entropy of the master session-signing key is a timestamp, recoverable from your own token; the assigned CVE-2025-15603 got rejected anyway, which tells you how the CNA game is going. Home Assistant 2026.11.0 stores token secrets in cleartext, never expires two token classes, and revokes none of them on password change -- 'your password is the key to your home' is PR spin that dies against a live install. The Perl graveyard reopened too: Dancer CVE-2015-10149 passes unvalidated cookie session ids straight to the engine, HTTP::Session CVE-2011-10042 turns a poisoned id into memcached command injection, and JSON::XS <4.05 packs seven CVEs including incr_parse buffering past max_size after a NUL. James Kettle's CSP work caps the theme: an allowlisted domain serving JSONP, uploads, or open redirects turns your blocked XSS right back into credential theft [PortSwigger / @albinowax]. Blind trust, compiled six different ways.

The parser front stayed predictably rotten. GPAC/MP4Box through 26.07.0 took a use-after-free in gf_sg_proto_del during XMT scene teardown plus two type confusions in appearance handling and field-replace commands -- crash-only at CVSS 5.5, but the scene-graph parser remains a fuzzer's playground. libdca, abandoned and dropped from VLC 4.0 yet still shipped by distros, took a second out-of-bounds read: bitstream_fill_current() in bitstream.c does tmp = *(state->buffer_start++) with no end-of-buffer check, so a malformed .dts file walks the pointer straight off the heap. Datadog flagged CVE-2026-118383, an unauthenticated use-after-free in MongoDB's primary catch-up path, and Vim <9.2.1346 lets a crafted keyword blow past PowerShell quoting in the keyword-lookup path into OS command execution. The closing signal is Project Zero reworking its 90+30 disclosure policy on the logic that machine-speed bug discovery has shrunk the useful patch window past what vendors can ship against -- a logic the FBI's flash on ARTEX makes concrete, with intrusions running from initial targeting to privileged access in under three hours. Datadog is already watching that tradecraft live in AWS: stolen access keys -> CloudWatch log hunting -> public Cognito user pools as the access door [Datadog Security Labs]. Risky Business #859 called the whole situation what it is: patch-and-response throughput is the bottleneck, and the attackers automated their queue first. Worth a 10-minute diff -- of your own patch process.