.   . . t h e d e a d . d o g ...
                                                    :
                                  ...c D d . . .. .  . .  .
            /\                  :                        .                  /\
           /  \  .              . .:: :::::::::::::::::. :              .  /  \
          / /\ \.::.            : ..:.:::::::::::::::::: :            .::./ /\ \
         / /  \::::::..         : :::.::::: ..`::::::::. :         ..::::::/  \ \
        / /    `:::::::::.......: :::::::::::::::::::::: :.......:::::::::'    \ \
       / /  cDd  `::::::::::::::: ::::::::::::::::::::'.::::::::::::::::'  ACiD \ \
      /_/         `:::::. `:::::: ::::::::::::::::::' .::::::' .::::::'          \_\
        |          ::::::..  ` ```::::''    ` :'    ``::::'''  ..::::::          |
        |          ::::::::::.....           .          .....::::::::::          |
        |         .::::::::::::::: :'   [ x ]   [ x ]  `:::::::::::::::.         |
        \        .::::::::::::::::.                      .::::::::::::::.        /
         \       | `::::::.:::::::: :.      ____      .::::::::::::::::'|       /
          \___   |     ` .. ....... :: .   /    \   .::: ....... .. '   |   ___/
              \  |                 : ::::. \____/ .:::: :               |  /
               \ |                 : ::::::_||||_:::::: :               | /
                \|                 . :: /\_/ \/ \_/\ :: .               |/
                                     :: \/ \_/\_/ \/ ::
                                     `::.          .::'
                                   8===8 `::::::::' 8===8

         _________________________/ - x X x - \________________________

                        /\___/\               .-. _)/
        _   _          / @   x \             (x,x) .\
       /_\_/_\       /\__\_V_/__/\            (u)   ()        /_\_/_\
       [ x x ]      /    8===8    \     _\)  .-="=-.//        [ - x ]
        \_Y_/       \/\/\/w w\/\/\/      \,//==\===            \_Y_/
        (' ')                             ()  =====            (' ')
       .-(U)-.  \(_           .-.         _____ =,=           .-(U)-.
      //==I==\\,/            (x.x)       ()--___(0V0)        //==I==\\
cDd // CULT OF THE DEAD DOG // CYBER INTEL & BUG BOUNTY WIRE • "Latrando, Vulnera Invenio"
[ STACK: 216 items (0.5 MiB / 16 GiB cap) ] [ NEWS: 47 | X: 110 | GIT: 59 ] [ SYNC: 2026-11-14 10:53 UTC ] [ AI: opencode-go/deepseek-v4.1-flash ]
[ RESET ]
=== [ DEEPSEEK FLASH BRIEF // THIS WEEK // LAST 7 DAYS ] ===2026-11-14 08:58 UTC (opencode-go/deepseek-v4.1-flash)
  • [James Kettle / @albinowax] "Blind trust: stealing credentials through CSP" — the big idea of the week: CSP allowlists that include a host serving user-controllable content (JSONP endpoints, upload buckets, open redirects) convert an HTML injection into credential theft even without script execution; the safety net becomes the exfil channel.
  • [Wordfence / Ram Gall] 497 vulnerabilities across 312 plugins + 1 theme landed in the Intelligence DB last week, with 218 credited researchers — the WordPress plugin ecosystem remains the highest-volume CVE firehose and the best hunting ground for pre-CVE diffing.
  • [Wordfence / Ram Gall] PSA on CVE-2026-119618: critical Apache HTTP/2 module RCE — patch priority for anyone hosting WordPress behind httpd with `mod_http2` enabled; assume mass scanning already started.
  • [Critical Thinking Podcast ep.200 / Nick Copi] Cloud hacking deep-dive: what actually counts as a cloud finding, how threat models shift when the "vulnerability" is an over-permissive trust policy or an IAM misconfiguration rather than a code bug.
  • [@xssdoctor] shipped `git-cve-2026-113408-poc` plus a whole battery of inert Git fixtures (partial-clone promisor `upload-pack`, option-injection filenames, CVE-2025-48384 submodule hook execution, nested-config probes) — a coordinated push against Git client trust boundaries.
  • [@vitorfhc] `vdet` update pushes the "negative-day" thesis: watch major OSS repos for silent security patches shipped before a CVE exists, then verify exploitability — pre-CVE intelligence as a repeatable pipeline.
  • [@dawgyg] `AppleResearch` (510★ in days) dumps raw macOS vulnerability research the author считает should have been patched but fell below bounty thresholds — a rare public corpus of Apple bug classes.
  • [Daniel Miessler] The Bitter Wall / Bitter Lesson Generalized: model capability now plateaus at "what you can articulate"; the differentiation moves to harness/orchestration design — relevant to how we build AI-assisted recon and triage.
=== [ POSSIBILITIES & HUNTING ANGLES // THIS WEEK // LAST 7 DAYS ] ===37 sources analyzed
  • Git-aware attack surface sweep inspired by [@xssdoctor]: enumerate every product that shells out to `git` (CI runners, Gerrit/GitLab/Gitea mirrors, IDE integrations, security scanners pulling repos) and test malicious server responses at protocol v2 — specifically unborn HEAD symref handling and branch-update resolution escaping `.git`, the CVE-2026-113408 pattern.
  • Option-injection hunting per [@xssdoctor] `muse-git-option-path`: grep internal tooling/backup scripts/scanners for `git` invocations building argv from repo paths or branch names without a `--` terminator; filenames or refs starting with `-` (`--upload-pack=`, `--config=`, `-c core.pager=`) become command execution.
  • Submodule/clone-hook RCE chain from [@xssdoctor] `muse-git-cve-2025-48384-*`: audit any pipeline doing `git clone --recurse-submodules` on untrusted repos; craft submodule content that gets installed as a checkout hook, and test whether hardened configs (`protocol.file.allow`, `core.hooksPath`) actually block it.
  • CSP-allowlist credential theft per [James Kettle] + the freshened matcher in [@renniepak] `CSPBypass` (now handles scheme-relative and multi-directive policies): for any target, diff its `script-src`/`connect-src` allowlist against known JSONP, AngularJS-on-CDN, upload-host, and open-redirect gadgets, then build a no-JS exfil chain that abuses `report-uri`/`form-action`/`img-src` allowlisted origins to capture tokens.
  • Negative-day plugin hunting modeled on [@vitorfhc] `vdet`, aimed at the [Wordfence] 497-vuln backlog: mirror WordPress.org SVN, diff consecutive plugin tags, flag releases with security-shaped changelogs ("sanitize", "capability check", "nonce") but no CVE, then verify exploitability against the previous version before disclosure.
  • Apache HTTP/2 CVE-2026-119618 blast-radius recon per [Wordfence]: fingerprint `mod_http2` + h2c upgrade support across WordPress hosting fleets, write a nuclei/httpx probe for HTTP/2 preface handling, and prioritize shared-hosting front ends where one httpd serves thousands of vhosts.
  • Cloud threat-modeling per [Critical Thinking / Nick Copi]: shift from "find the bug" to "find the trust": enumerate CI OIDC trust policies with wildcard `sub` claims, cross-account `sts:AssumeRole` graphs, and SSRF→IMDSv1 leftovers; treat every over-permissive role as a reportable finding with a concrete escalation path.
  • Tooling build: fork [@JorianWoltjer] `responder` (now supports loading content from a URL and `Content-Length`) as the delivery layer for CSP/credential-theft PoCs — query-param-driven headers make it trivial to spin up per-target allowlisted-origin simulations mid-engagement.
=== [ CYBER NEWS, RESEARCH BLOGS & PODCASTS (THIS WEEK // LAST 7 DAYS) ] ===8 items
NEWS/BLOG • Ram Gall2026-11-12 16:38 UTC
Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)
Wordfence's weekly report tallies 497 vulnerabilities across 312 WordPress plugins and one theme, contributed by 218 researchers, highlighting plugin-heavy disclosure volume.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Last week, there were 497 vulnerabilities disclosed in 312 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026) appeared first on Wordfence .
NEWS/BLOG • Ram Gall2026-11-12 14:39 UTC
PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know
Critical Apache HTTP/2 flaw CVE-2026-119618 can enable remote code execution; WordPress owners on Apache should confirm their host has applied the fix.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Apache has released a fix for a critical vulnerability in the HTTP/2 module of Apache HTTP Server. The issue, CVE-2026-119618, can lead to remote code execution on affected servers. If your WordPress site is hosted on Apache, check your host’s website or announcements to see if they have already fixed this. If you can’t find ... Read More The post PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know appeared first on Wordfence .
PODCAST • Critical Thinking Podcast (Mirror)2026-11-12 10:00 UTC
Episode 200: Cloud Hacking w/ Nick Copi
Critical Thinking episode discusses cloud hacking scope, threat models, and how providers and attackers can use or misuse cloud services.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Episode 200: In this episode of Critical Thinking - Bug Bounty Podcast JD sits down with Nick Copi to pick his brain about Cloud Hacking. They talk through what actually qualifies and the cloud, threat models, and how providers can use and misuse cloud services. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discor...
NEWS/BLOG • James Kettle (albinowax)2026-11-11 14:26 UTC
Blind trust: stealing credentials through CSP
PortSwigger research shows CSP can be bypassed when an allow-listed domain hosts exploitable gadgets or endpoints, enabling credential theft despite the policy.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Content Security Policy is supposed to be the safety net that stops an HTML injection from turning into XSS. Usually it works. But sometimes it doesn't, because the policy allows-lists a domain that h
NEWS/BLOG • Daniel Miessler2026-11-10 21:50 UTC
The Bitter Wall
Miessler argues model output quality plateaus at a "Bitter Wall" set by what users can articulate, and better harness/context can raise that ceiling.
[ SOURCE -> ]
[ + RAW EXCERPT ]
A chart of output quality against model intelligence: a purple curve rises steeply, then flattens under a brick wall labeled The Bitter Wall, whose height is marked What you can articulate; a teal arrow labeled Better articulation: harness + context lifts the ceiling to a higher dashed line, and a d...
NEWS/BLOG • Ram Gall2026-11-10 18:27 UTC
What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts
Wordfence 9.1.0 adds a security news widget, faster firewall rule updates, sharper request parsing, logging for app-password/REST API login failures, and configurable alert thresholds.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Wordfence 9.1.0 is now available. It adds the new Wordfence Security News Widget, which brings the latest WordPress security alerts and research to your dashboard, plus faster firewall rule updates, sharper request parsing, Live Traffic logging for application password and REST API login failures, and configurable attack alert thresholds. The post What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts appeared first on Wordfence .
NEWS/BLOG • Daniel Miessler2026-11-07 19:30 UTC
The Bitter Lesson, Generalized
Miessler generalizes the Bitter Lesson, suggesting general methods that scale with compute/context outperform hand-crafted, domain-specific approaches.
[ SOURCE -> ]
[ + RAW EXCERPT ]
A charcoal sketch of an ornate carved stone gate whose emblem, a giant stone hand raised palm-out in refusal, has been split by the roots of a huge tree whose crown towers over the gate/images/bitter-lesson-generalized-header.webp/images/bitter-lesson-generalized-header.webp Just had a thought tha...
NEWS/BLOG • Daniel Miessler2026-11-07 18:38 UTC
Vibe Coding Isn't Using AI to Make Things
Miessler argues "vibe coding" is not merely using AI to build things; the distinction centers on working inside an open, inspectable engine versus relying on a sealed black box.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Two builders with the same AI arm feeding both engines: one works inside the open engine, the other leans on a sealed purple box/images/vibe-coding-isnt-using-ai.webp/images/vibe-coding-isnt-using-ai.webp Slight ok medium-sized pet peeve here. Vibe Coding isn't using AI to make things. Vibe Codi...
Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-12 16:38 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Wordfence's weekly report tallies 497 vulnerabilities across 312 WordPress plugins and one theme, contributed by 218 researchers, highlighting plugin-heavy disclosure volume.
[ CACHED SOURCE EXCERPT ]:
Last week, there were 497 vulnerabilities disclosed in 312 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026) appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-12 14:39 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Critical Apache HTTP/2 flaw CVE-2026-119618 can enable remote code execution; WordPress owners on Apache should confirm their host has applied the fix.
[ CACHED SOURCE EXCERPT ]:
Apache has released a fix for a critical vulnerability in the HTTP/2 module of Apache HTTP Server. The issue, CVE-2026-119618, can lead to remote code execution on affected servers. If your WordPress site is hosted on Apache, check your host’s website or announcements to see if they have already fixed this. If you can’t find ... Read More The post PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
Episode 200: Cloud Hacking w/ Nick Copi
SOURCE: Critical Thinking Podcast (Mirror) • ROLE: Official Show • PUBLISHED: 2026-11-12 10:00 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Critical Thinking episode discusses cloud hacking scope, threat models, and how providers and attackers can use or misuse cloud services.
[ CACHED SOURCE EXCERPT ]:
Episode 200: In this episode of Critical Thinking - Bug Bounty Podcast JD sits down with Nick Copi to pick his brain about Cloud Hacking. They talk through what actually qualifies and the cloud, threat models, and how providers can use and misuse cloud services. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discor...
[ OPEN ORIGINAL URL -> ]
Blind trust: stealing credentials through CSP
SOURCE: James Kettle (albinowax) • ROLE: Guest • PUBLISHED: 2026-11-11 14:26 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
PortSwigger research shows CSP can be bypassed when an allow-listed domain hosts exploitable gadgets or endpoints, enabling credential theft despite the policy.
[ CACHED SOURCE EXCERPT ]:
Content Security Policy is supposed to be the safety net that stops an HTML injection from turning into XSS. Usually it works. But sometimes it doesn't, because the policy allows-lists a domain that h
[ OPEN ORIGINAL URL -> ]
The Bitter Wall
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-10 21:50 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Miessler argues model output quality plateaus at a "Bitter Wall" set by what users can articulate, and better harness/context can raise that ceiling.
[ CACHED SOURCE EXCERPT ]:
A chart of output quality against model intelligence: a purple curve rises steeply, then flattens under a brick wall labeled The Bitter Wall, whose height is marked What you can articulate; a teal arrow labeled Better articulation: harness + context lifts the ceiling to a higher dashed line, and a d...
[ OPEN ORIGINAL URL -> ]
What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-10 18:27 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Wordfence 9.1.0 adds a security news widget, faster firewall rule updates, sharper request parsing, logging for app-password/REST API login failures, and configurable alert thresholds.
[ CACHED SOURCE EXCERPT ]:
Wordfence 9.1.0 is now available. It adds the new Wordfence Security News Widget, which brings the latest WordPress security alerts and research to your dashboard, plus faster firewall rule updates, sharper request parsing, Live Traffic logging for application password and REST API login failures, and configurable attack alert thresholds. The post What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
The Bitter Lesson, Generalized
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-07 19:30 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Miessler generalizes the Bitter Lesson, suggesting general methods that scale with compute/context outperform hand-crafted, domain-specific approaches.
[ CACHED SOURCE EXCERPT ]:
A charcoal sketch of an ornate carved stone gate whose emblem, a giant stone hand raised palm-out in refusal, has been split by the roots of a huge tree whose crown towers over the gate/images/bitter-lesson-generalized-header.webp/images/bitter-lesson-generalized-header.webp Just had a thought tha...
[ OPEN ORIGINAL URL -> ]
Vibe Coding Isn't Using AI to Make Things
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-07 18:38 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Miessler argues "vibe coding" is not merely using AI to build things; the distinction centers on working inside an open, inspectable engine versus relying on a sealed black box.
[ CACHED SOURCE EXCERPT ]:
Two builders with the same AI arm feeding both engines: one works inside the open engine, the other leans on a sealed purple box/images/vibe-coding-isnt-using-ai.webp/images/vibe-coding-isnt-using-ai.webp Slight ok medium-sized pet peeve here. Vibe Coding isn't using AI to make things. Vibe Codi...
[ OPEN ORIGINAL URL -> ]