THE DEAD DOG // thedead.dog [THIS MONTH // LAST 30 DAYS]

                     .   . . t h e d e a d . d o g ...
                                                    :
                                  ...c D d . . .. .  . .  .
            /\                  :                        .                  /\
           /  \  .              . .:: :::::::::::::::::. :              .  /  \
          / /\ \.::.            : ..:.:::::::::::::::::: :            .::./ /\ \
         / /  \::::::..         : :::.::::: ..`::::::::. :         ..::::::/  \ \
        / /    `:::::::::.......: :::::::::::::::::::::: :.......:::::::::'    \ \
       / /  cDd  `::::::::::::::: ::::::::::::::::::::'.::::::::::::::::'  ACiD \ \
      /_/         `:::::. `:::::: ::::::::::::::::::' .::::::' .::::::'          \_\
        |          ::::::..  ` ```::::''    ` :'    ``::::'''  ..::::::          |
        |          ::::::::::.....           .          .....::::::::::          |
        |         .::::::::::::::: :'   [ x ]   [ x ]  `:::::::::::::::.         |
        \        .::::::::::::::::.                      .::::::::::::::.        /
         \       | `::::::.:::::::: :.      ____      .::::::::::::::::'|       /
          \___   |     ` .. ....... :: .   /    \   .::: ....... .. '   |   ___/
              \  |                 : ::::. \____/ .:::: :               |  /
               \ |                 : ::::::_||||_:::::: :               | /
                \|                 . :: /\_/ \/ \_/\ :: .               |/
                                     :: \/ \_/\_/ \/ ::
                                     `::.          .::'
                                   8===8 `::::::::' 8===8

         _________________________/ - x X x - \________________________

                        /\___/\               .-. _)/
        _   _          / @   x \             (x,x) .\
       /_\_/_\       /\__\_V_/__/\            (u)   ()        /_\_/_\
       [ x x ]      /    8===8    \     _\)  .-="=-.//        [ - x ]
        \_Y_/       \/\/\/w w\/\/\/      \,//==\===            \_Y_/
        (' ')                             ()  =====            (' ')
       .-(U)-.  \(_           .-.         _____ =,=           .-(U)-.
      //==I==\\,/            (x.x)       ()--___(0V0)        //==I==\\

cDd // CULT OF THE DEAD DOG // CYBER INTEL & BUG BOUNTY WIRE • "Latrando, Vulnera Invenio"

[ STACK: 216 items (0.5 MiB / 16 GiB cap) ] [ NEWS: 47 | X: 110 | GIT: 59 ] [ SYNC: 2026-11-14 10:53 UTC ] [ AI: opencode-go/deepseek-v4.1-flash ]

=== [ DEEPSEEK FLASH BRIEF // THIS MONTH // LAST 30 DAYS ] ===2026-11-14 08:59 UTC (opencode-go/deepseek-v4.1-flash)

WordPress 7.1.4 (Oct 28, 2026) patched 22 flaws including an unauthenticated race-condition RCE in the core upgrade path, and Wordfence is already seeing active probing for it — this is the highest-urgency item in the window [Ram Gall / Wordfence].
Two infrastructure-grade RCEs landed back-to-back: Apache HTTP/2 CVE-2026-119618 (mod_http2, RCE) and the Brotli CVE-2026-111497 "HTTP2Shell" chain — both directly relevant to shared WordPress hosting where nobody controls the httpd build [Wordfence].
@albinowax dropped three bangers: CSP allow-list abuse for credential theft ("Blind trust"), a CRLF-powered desync check that escalates plain header injection to critical via a single prompt, and "Scalable Vector Grief" — 6 of 8 SVG sanitizers bypassed, with a response *header* alone executing JS in Firefox [James Kettle].
WordPress ecosystem volume remains brutal: 497 vulns across 312 plugins in one week, 549 the week prior — plugin-level hunting is still a numbers game with a very low signal bar [Wordfence Intelligence].
Critical Thinking Ep. 200 (Cloud Hacking w/ Nick Copi) and Ep. 197 ("800 Bugs w/ DeepSeek + Local Model Hacks") are the two episodes worth your time — cloud threat-model framing and local-model-driven bug volume [Critical Thinking Podcast].
@rez0__ took 2nd overall at Google Bugswat Singapore against ~50 hackers — worth watching what he publishes next [@rez0__].
GitHub signal is dominated by @xssdoctor's Git client-side fixture corpus and @vitorfhc's "negative-day" pre-CVE detector — both are pre-disclosure hunting machinery, not retro PoCs.

=== [ POSSIBILITIES & HUNTING ANGLES // THIS MONTH // LAST 30 DAYS ] ===75 sources analyzed

Git client-side RCE/escape sweep: @xssdoctor's fixture set now covers unborn HEAD symref escape (CVE-2026-113408), partial-clone promisor `upload-pack` execution (CVE-2024-32004), submodule hook injection (CVE-2025-48384), and option-injection via filenames beginning with `-`. Audit every service that clones attacker-influenced repos: CI runners, dependency bots, IDE/SCM plugins, monorepo vendoring scripts, AI coding agents with `git clone` tools. Build a argv-fuzzing shim that wraps `git` and logs missing `--` terminators.
CSP allow-list → credential theft (per @albinowax "Blind trust"): enumerate targets whose CSP whitelists third-party hosts, then diff those hosts for JSONP endpoints, open redirects, user-content subdomains, and Angular/library sinks. Pair with [renniepak/CSPBypass]'s fresh matcher fix for scheme-relative and multi-directive policies — its parser was just corrected, meaning previously-missed policies now resolve.
CRLF header-injection escalation: @albinowax's new check turns boring header injection into desync. Re-audit every parameter that lands in a response or forwarded header — filename fields, redirect/locale params, `X-Forwarded-Host`, CDN cache keys — and instrument a crawler to flag any reflected CR/LF into headers, then test for response splitting and cache poisoning rather than blind XSS.
SVG sanitizer bypass at scale: test upload/preview pipelines against the "Scalable Vector Grief" methodology — the kill shot isn't in the XML, it's in how the response is *served*. Focus on attacker-influenced `Content-Type`, `Content-Disposition`, multipart, and charset headers on any endpoint that reflects user SVG (avatars, invoices, e-signature, chart export).
Shared-hosting HTTP/2 & Brotli blast radius: mass-fingerprint mod_http2 versions and Brotli handling behind WordPress/asset hosts, prioritize multi-tenant hosts where a single httpd RCE = hundreds of tenants. Build a low-noise h2 prober that avoids crashing production.
Upgrade-window race replication: WordPress's unauthenticated TOCTOU in the core updater is a pattern, not a one-off. Hunt the same shape in plugin/theme auto-updaters, WP-CLI wrappers, and other PHP CMSes (Joomla/Drupal/October) — look for update flows that write-then-verify with an attacker-observable window and no locking.
Negative-day pipeline (inspired by @vitorfhc/videt): watch high-value OSS repos for commits that touch sanitizers, parsers, authz, or deserializers with no CVE, no advisory, and terse messages. Auto-diff, auto-classify exploitability, auto-draft a PoC skeleton — you beat the advisory feed by days.
MCP/agent attack surface: [assetnote/assetnote-mcp-server-public-docs] documents an AI-to-attack-surface bridge, and [7urb0/intent-anchor] exists precisely because agents drift from constraints. Test MCP servers for prompt-injection → privileged-action chains, and probe approval boundaries where "read-only" tools can be steered into mutations.

=== [ TWEETS // X STREAM (THIS MONTH // LAST 30 DAYS) ] ===1 items

X / TWEET • @rez0__ (Joseph Thacker)2026-10-25 12:37 UTC

I got second overall at the Google Bugswat in Singapore!! 🎉☺️ It was a talented group of almost 50 hackers so I am really proud of the findi...

I got second overall at the Google Bugswat in Singapore!! 🎉☺️ It was a talented group of almost 50 hackers so I am really proud of the findings and thankful to have been invited! https://t.co/dSbsyotAxV

[ SOURCE -> ]