The last 24 hours on GitHub are mostly Google infrastructure maintenance plus Caido tooling maturation, with one standout offensive artifact: [@xssdoctor]’s new `git-cve-2026-113408-poc`, which packages a loopback-only smart-HTTP fixture to demonstrate a protocol-v2 server feeding an unsafe unborn HEAD symref and escaping `.git` during branch-update resolution. The broader trend is “security-adjacent maintenance with exploit value”: [@vitorfhc] is refining silent-patch detection, [@google] is churning ANGLE/Dawn/XNNPACK native code and reshaping `goonami-scanner`’s fingerprint engine, while [@caido] is expanding its extension SDK/docs and hardening installs via `mise-toolshed`. Nothing here is a mass-exploit release, but the Git symref PoC and the negative-day detection thesis are immediately actionable; the GPU and scanner changes deserve diff-level inspection rather than headline attention.
Inspect now: [@xssdoctor] `git-cve-2026-113408-poc` — reproduce the symref escape, then port the fixture to other Git clients and CI checkout paths.
Watch: [@vitorfhc] `vdet` — the README update sharpens the “silent patch before CVE” workflow; steal the differential-detection model.
Diff: [@google] `goonami-scanner` — declarative `webidentity` fingerprinter and removal of legacy binproto signatures/hash registry may change detection fidelity and plugin trust boundaries.
Track: [@caido] `sdk-js` v0.59.1, `documentation` capture-menu/highlight docs, and `mise-toolshed` checksum/min-release-age enforcement — extension attack surface plus supply-chain control bypass hypotheses.
Monitor: [@google] `angle`, `dawn`, and `XNNPACK` commits for memory-safety and numerical-edge-case regressions; [@danielmiessler] `SecLists` Trickest refreshes and `Fabric` pushes for recon-input and prompt-injection drift.
XNNPACK is Google's high-efficiency floating-point neural-network inference operator library for mobile, server, and Web. Recent work adds float zero-point support in YNNPACK blockwise dot, fixes output_slice dimension mapping, and migrates the scheduler.
TRMNL Astro is a small Python project that fetches planetary positions from a self-hosted Astrologer API, renders a wheel/legend chart for a TRMNL e-ink display, and serves it via GitHub Pages.
Dawn is Google's native WebGPU implementation. Recent commits fix SharedTextureMemoryTest on Mac Debug, roll Mesa 131 revisions, and add D3D11 import of Y410 shared texture memory as RGB10A2Unorm.
ANGLE is a conformant OpenGL ES implementation for Windows, Mac, Linux, iOS, and Android. Recent commits invalidate D3D11 swizzle cache on PBO fast unpack, flush before draw-framebuffer changes on PowerVR, and skip i_am_security on Win/ARM64.
Nomulus is Google's top-level domain registry service on Google Cloud Platform. Recent commits add repo-based release-image build configs, cap domains loaded per list_domains request, and mark EAP/XAP fees non-standard/non-refundable.
Goonami is a Go network security scanner with an extensible plugin system for high-confidence, high-severity vulnerability detection. Recent changes drop legacy binproto signatures/hash registry and move the webidentity fingerprinter to a declarative engine.
XLS is Google's accelerated hardware synthesis toolchain. Recent commits integrate LLVM at c54ccc6bbe29, add resource-sharing profitability guard/legalizer helpers, and change mul-splitter equivalence mapping to use concats and estimate area.
Grain is a Python library for reading and processing ML training data. Recent changes bump the version after 0.2.19, temporarily remove torch_random_map before live release, and refactor grain.experimental from a module into a package.
Mug is a small Java 8 utility library covering string manipulation, BiStream, structured concurrency, and SQL templates. Recent commits update coverage badges and add SafeSql.or()/and() support for non-stream inputs.
About caido/documentation: 📙 User documentation for Caido. Recent commits: Yanni/doc 73 add documentation for the new capture menu in (#409) | Added docs for HTTP History Highlight color (#408) | Added an download link in the top nav bar (#406)
About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Recent commits: chore(release): Update version to v1.4.575 | Merge pull request #2341 from gabsferreira/feat/searchapi-search | Merge pull request #2340 from Rutvij97/feat/investigation-visualization-mermaid
vdet is a Python tool that monitors major open-source projects for silent security patches, spotting vulnerability fixes before a CVE is assigned and checking whether they're actually exploitable. Latest push updates the README describing this "negative-day" detection window.
caido/sdk-js is the monorepo housing Caido's JavaScript SDKs and related tooling, used by developers building extensions for the Caido web security testing platform. The recent push prepares coupled SDK packages for the v0.59.1 release.
SecLists is the widely used collection of security testing wordlists—usernames, passwords, fuzzing payloads, web shells and more—used across pentests and bug bounties. The latest push auto-updates the Trickest-derived wordlists via GitHub Action.
A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
mise-toolshed is a mise backend plugin installing small utility tools that verify exact versions, lockfiles, and minimum release age, refusing installs when downloaded SHA-256 checksums mismatch. The recent push updates these release-verified toolshed commands.
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:52 UTC
[ DEEPSEEK FLASH ANALYSIS ]: XNNPACK is Google's high-efficiency floating-point neural-network inference operator library for mobile, server, and Web. Recent work adds float zero-point support in YNNPACK blockwise dot, fixes output_slice dimension mapping, and migrates the scheduler.
[ CACHED SOURCE EXCERPT ]: About google/XNNPACK: High-efficiency floating-point neural network inference operators for mobile, server, and Web. Recent commits: Support floating-point zero points in YNNPACK blockwise dot. | Account for output_slice when mapping stack output dimensions | Migrate YNNPACK scheduler to the new slinky::loop_nest.
SOURCE: Alex Rice (@arice) • ROLE: Guest • PUBLISHED: 2026-11-14 08:48 UTC
[ DEEPSEEK FLASH ANALYSIS ]: TRMNL Astro is a small Python project that fetches planetary positions from a self-hosted Astrologer API, renders a wheel/legend chart for a TRMNL e-ink display, and serves it via GitHub Pages.
[ CACHED SOURCE EXCERPT ]: README: # TRMNL Astrology Chart Displays current planetary positions on your TRMNL e-ink display. Fetches position data from a self-hosted Astrologer API, renders a custom wheel + legend chart, and serves it via GitHub Pages. ## Features - **5-Minute Updates**: Automatically updates planetary positions via GitHub Actions - **Custom Chart Rendering**: Clean wheel + legend layout optimized for e-ink - **Self-Hosted API**: Uses your own Astrologer API (Kerykeion-based) - **GitHub Pages**: Chart hosted publicly, no base64 encoding needed - **Whole Sign Houses**: Traditional house system with ASC at 9 o'clock ## Prerequisites 1. **Self-hosted Astrologer A.... Recent commits: Update chart: 2026-11-14 08:48 UTC | Update chart: 2026-11-14 08:42 UTC | Update chart: 2026-11-14 08:36 UTC
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:47 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Dawn is Google's native WebGPU implementation. Recent commits fix SharedTextureMemoryTest on Mac Debug, roll Mesa 131 revisions, and add D3D11 import of Y410 shared texture memory as RGB10A2Unorm.
[ CACHED SOURCE EXCERPT ]: About google/dawn: Native WebGPU implementation. Mirror of https://dawn.googlesource.com/dawn. File bugs here: https://crbug.com/dawn/new. Recent commits: [dawn][metal] Fix SharedTextureMemoryTest on Mac Debug | Roll Mesa from e9b12c2774a7 to f4ab1f91b074 (131 revisions) | [d3d11] Import Y410 shared texture memory as RGB10A2Unorm
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:34 UTC
[ DEEPSEEK FLASH ANALYSIS ]: ANGLE is a conformant OpenGL ES implementation for Windows, Mac, Linux, iOS, and Android. Recent commits invalidate D3D11 swizzle cache on PBO fast unpack, flush before draw-framebuffer changes on PowerVR, and skip i_am_security on Win/ARM64.
[ CACHED SOURCE EXCERPT ]: About google/angle: A conformant OpenGL ES implementation for Windows, Mac, Linux, iOS and Android.. Recent commits: D3D11: Invalidate swizzle cache on PBO fast unpack | GL: Flush before changing draw framebuffer on PowerVR | Skip i_am_security on Win/ARM64
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:26 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Nomulus is Google's top-level domain registry service on Google Cloud Platform. Recent commits add repo-based release-image build configs, cap domains loaded per list_domains request, and mark EAP/XAP fees non-standard/non-refundable.
[ CACHED SOURCE EXCERPT ]: About google/nomulus: Top-level domain name registry service on Google Cloud Platform. Recent commits: Add configs to build release images from the repo (#3270) | Cap domains loaded per list_domains request (#3271) | Mark EAP and XAP fees non-standard/non-refundable (#3267)
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:24 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Goonami is a Go network security scanner with an extensible plugin system for high-confidence, high-severity vulnerability detection. Recent changes drop legacy binproto signatures/hash registry and move the webidentity fingerprinter to a declarative engine.
[ CACHED SOURCE EXCERPT ]: About google/goonami-scanner: Goonami is a general purpose network security scanner, written in Golang, with an extensible plugin system for detecting high severity vulnerabilities with high confidence.. Recent commits: fp/webidentity: remove legacy binproto signatures and hash registry | Copybara import of the project: | fp/webidentity: switch fingerprinter to the declarative engine
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:16 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Grain is a Python library for reading and processing ML training data. Recent changes bump the version after 0.2.19, temporarily remove torch_random_map before live release, and refactor grain.experimental from a module into a package.
[ CACHED SOURCE EXCERPT ]: About google/grain: Library for reading and processing ML training data.. Recent commits: Bump Grain version after the release of 0.2.19. | temporarily removed torch_random_map before live release; this will be refactored into a different shape and released together with other related libraries. | Refactor `grain.experimental` from a module file into a package.
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:05 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Mug is a small Java 8 utility library covering string manipulation, BiStream, structured concurrency, and SQL templates. Recent commits update coverage badges and add SafeSql.or()/and() support for non-stream inputs.
[ CACHED SOURCE EXCERPT ]: About google/mug: A small Java 8 library (string manipulation, BiStream, Structured Concurrency, SQL Templates). Recent commits: Update coverage badges | SafeSql.or()/and() for non-stream | Update coverage badges
SOURCE: Caido Official (@caido) • ROLE: Guest Org (Emile Fugulin) • PUBLISHED: 2026-11-13 23:07 UTC
[ CACHED SOURCE EXCERPT ]: About caido/documentation: 📙 User documentation for Caido. Recent commits: Yanni/doc 73 add documentation for the new capture menu in (#409) | Added docs for HTTP History Highlight color (#408) | Added an download link in the top nav bar (#406)
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-13 20:39 UTC
[ CACHED SOURCE EXCERPT ]: About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Recent commits: chore(release): Update version to v1.4.575 | Merge pull request #2341 from gabsferreira/feat/searchapi-search | Merge pull request #2340 from Rutvij97/feat/investigation-visualization-mermaid
[ DEEPSEEK FLASH ANALYSIS ]: vdet is a Python tool that monitors major open-source projects for silent security patches, spotting vulnerability fixes before a CVE is assigned and checking whether they're actually exploitable. Latest push updates the README describing this "negative-day" detection window.
[ CACHED SOURCE EXCERPT ]: README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
SOURCE: Caido Official (@caido) • ROLE: Guest Org (Emile Fugulin) • PUBLISHED: 2026-11-13 19:34 UTC
[ DEEPSEEK FLASH ANALYSIS ]: caido/sdk-js is the monorepo housing Caido's JavaScript SDKs and related tooling, used by developers building extensions for the Caido web security testing platform. The recent push prepares coupled SDK packages for the v0.59.1 release.
[ CACHED SOURCE EXCERPT ]: About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling. Recent commits: Merge pull request #60 from caido/release/v0.59.1 | Prepare coupled SDKs for v0.59.1 | Prepare coupled SDKs for v0.59.1-rc.1
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-13 17:10 UTC
[ DEEPSEEK FLASH ANALYSIS ]: SecLists is the widely used collection of security testing wordlists—usernames, passwords, fuzzing payloads, web shells and more—used across pentests and bug bounties. The latest push auto-updates the Trickest-derived wordlists via GitHub Action.
[ CACHED SOURCE EXCERPT ]: About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-13 12:46 UTC
[ DEEPSEEK FLASH ANALYSIS ]: A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
[ CACHED SOURCE EXCERPT ]: Newly created repository.README: # CVE-2026-113408 bounded Git PoC This repository contains a loopback-only smart HTTP fixture for testing CVE-2026-113408: a Git client can accept an unsafe unborn `HEAD` symref from a protocol-v2 server and later resolve the first branch update outside `.git`. The harness creates one empty bare repository and changes only the unborn HEAD target in the server's `ls-refs` response: ```text refs/heads/../../../../CVE_2026_113408_MARKER.txt ``` The first commit in a vulnerable clone can therefore write the new commit ID to the fixed marker in the clone's dedicated parent. ## Important GitHub limitation GitHub hosts this source and reproduction h...
SOURCE: Caido Official (@caido) • ROLE: Guest Org (Emile Fugulin) • PUBLISHED: 2026-11-13 12:18 UTC
[ DEEPSEEK FLASH ANALYSIS ]: mise-toolshed is a mise backend plugin installing small utility tools that verify exact versions, lockfiles, and minimum release age, refusing installs when downloaded SHA-256 checksums mismatch. The recent push updates these release-verified toolshed commands.
[ CACHED SOURCE EXCERPT ]: README: # mise-toolshed [mise](https://mise.jdx.dev/) backend plugin that installs small utility tools. Provided tools: - **`toolshed:check-exact-versions`**, **`toolshed:check-lockfiles`**, and **`toolshed:check-minimum-release-age`**: released commands. Pushing ` -v ` publishes ` .mjs` and `SHA256SUMS`. The plugin downloads that release and refuses the install when the SHA-256 does not match. Each tool is first released as `1.0.0`. - **`toolshed:get-skills`**: a `get-skills` command which installs the [`skills/`](https://github.com/caido/ai-ops/tree/main/skills) tree from **[ai-ops](https://github.com/caido/ai-ops)** into one personal folder you ch.... Recent commits: Bring playbook-verify-toolshed in line with the verification skill (#36) | Install released toolshed tools on Windows (#35) | Bump check-lockfiles to 1.0.1 (#34)