=== [ GITHUB // NEW REPOS & CODE CHANGES (THIS MONTH // LAST 30 DAYS) ] ===55 repo events
[ DEEPSEEK GITHUB STATEMENT // THIS MONTH // LAST 30 DAYS ]:
This window's GitHub telemetry reads as a coordinated pivot toward *pre-disclosure, client-side, and tooling-layer* tradecraft rather than headline CVE churn. @xssdoctor is the dominant actor, shipping a coherent corpus of inert, marker-only Git fixtures — `git-cve-2026-113408-poc` (unborn HEAD symref escape), `muse-git-local-partial-archive-20261113` (CVE-2024-32004 promisor `upload-pack`), the paired `muse-git-cve-2025-48384-parent/sub-20261113` submodule hook-injection set, `muse-git-option-path-20261113` (`--` terminator / option injection), and `muse-nested-git-config-probe-20261113` — all deliberately sandboxed with fixed-marker side effects, which is exactly how you distribute reproductions without becoming the incident. Alongside that, @vitorfhc's `vdet` continues maturing as a "negative-day" hunter for silently patched OSS, Google's `goonami-scanner` is ripping out legacy binproto signatures in favor of a declarative fingerprinting engine, and the Caido ecosystem (`sdk-js` v0.59.1, plugin `store` merging Wsdler, docs for the new capture menu) shows steady extension-platform investment. Less obvious but notable: [dawgyg/AppleResearch] dumping a large corpus of unreported-below-threshold macOS findings, [assetnote/assetnote-mcp-server-public-docs] formalizing AI-to-attack-surface querying, and [renniepak/CSPBypass]'s matcher fix landing in the same window as Kettle's CSP research. Watch for noise and squatting too — several newly created `xssdoctor/*` JS repos (`widget-glyph-suite`, `badge-core-lite-v2`) have no security relevance and are worth flagging as possible namespace padding.
Immediate inspection: `xssdoctor/git-cve-2026-113408-poc` and the `muse-git-*` fixture family — run them against your CI clone path and any tool that ingests untrusted repositories.
Trend: security PoCs are being published as *safe, deterministic, network-free* fixtures with marker side effects — adopt this pattern for your own disclosures.
Watch: `vitorfhc/videt` is the closest thing to an automated pre-CVE pipeline in this window; fork it and point it at your target stack.
Tooling: `google/goonami-scanner`'s move to a declarative webidentity fingerprinter is a sign the scanner OSS ecosystem is converging on declarative, reloadable detection definitions.
Low-signal but worth a bookmark: `renniepak/CSPBypass` (scheme-relative fix) and `JorianWoltjer/responder` (query-param-driven header/HTML PoC builder) both directly accelerate CSP and header-injection testing.
google/hdmitsuba is a USD Hydra delegate that lets Pixar's Universal Scene Description render through Mitsuba 3, useful for researchers testing physically-based rendering pipelines; recent commits add AGENTS.md design guidelines and stop overriding RenderSettings prim values, logging unsupported material features only in debug.
arice/trmnl-astro is a small Python project that fetches planetary position data from a self-hosted Astrologer API and renders a wheel-plus-legend astrology chart for TRMNL e-ink displays via GitHub Actions and Pages; no security-relevant changes noted, only README/initial push.
google/adk-js is Google's open-source TypeScript toolkit for building, evaluating, and deploying AI agents; recent commits add --reload_agents CLI hot-reload of only changed agents, request timeouts and card-resolution errors for RemoteA2AAgent, and auth-required task states with runner caching.
SecLists is the widely used security tester's companion repo: a curated collection of wordlists for usernames, passwords, URLs, fuzzing payloads, web shells, and sensitive data patterns; the latest commits are automated GitHub Action updates refreshing the Trickest-derived wordlists.
gVisor is Google's application kernel for containers, providing a user-space sandboxed Linux kernel to isolate untrusted workloads; recent commits fix missing filestore cleanup and, notably, confine the sandbox to a device cgroup to tighten container escape surface.
ANGLE is Google's conformant OpenGL ES implementation across Windows, Mac, Linux, iOS and Android, heavily used in browser GPU sandboxing; recent commits recreate texture IDs before glTexStorage, use std430 for default uniform blocks in WGSL IR, and deduplicate matrix uniform copy helpers.
elephant-goldfish-model is a Google open-source plugin for designing and reviewing software with AI agents; recent changes bump Astro from 7.4.5 to 7.4.12 (dependency fix) and add an experimental Windsurf (Devin Desktop) adapter plus explainer layout tweaks.
google/moodle-on-gcp provides Google Cloud-engineered reference resources for deploying Moodle on GCP using containers and Kubernetes for scalable education workloads; the excerpt shows only a README refresh, no functional or security changes.
xls (Accelerated HW Synthesis) is Google's C++ toolchain and DSL for generating hardware designs from higher-level specifications; recent commits integrate upstream LLVM revisions and add resource-sharing profitability guards and legalizer helpers.
XNNPACK is Google's high-efficiency floating-point neural-network inference operator library for mobile, server, and Web. Recent work adds float zero-point support in YNNPACK blockwise dot, fixes output_slice dimension mapping, and migrates the scheduler.
TRMNL Astro is a small Python project that fetches planetary positions from a self-hosted Astrologer API, renders a wheel/legend chart for a TRMNL e-ink display, and serves it via GitHub Pages.
Dawn is Google's native WebGPU implementation. Recent commits fix SharedTextureMemoryTest on Mac Debug, roll Mesa 131 revisions, and add D3D11 import of Y410 shared texture memory as RGB10A2Unorm.
ANGLE is a conformant OpenGL ES implementation for Windows, Mac, Linux, iOS, and Android. Recent commits invalidate D3D11 swizzle cache on PBO fast unpack, flush before draw-framebuffer changes on PowerVR, and skip i_am_security on Win/ARM64.
Nomulus is Google's top-level domain registry service on Google Cloud Platform. Recent commits add repo-based release-image build configs, cap domains loaded per list_domains request, and mark EAP/XAP fees non-standard/non-refundable.
Goonami is a Go network security scanner with an extensible plugin system for high-confidence, high-severity vulnerability detection. Recent changes drop legacy binproto signatures/hash registry and move the webidentity fingerprinter to a declarative engine.
XLS is Google's accelerated hardware synthesis toolchain. Recent commits integrate LLVM at c54ccc6bbe29, add resource-sharing profitability guard/legalizer helpers, and change mul-splitter equivalence mapping to use concats and estimate area.
Grain is a Python library for reading and processing ML training data. Recent changes bump the version after 0.2.19, temporarily remove torch_random_map before live release, and refactor grain.experimental from a module into a package.
Mug is a small Java 8 utility library covering string manipulation, BiStream, structured concurrency, and SQL templates. Recent commits update coverage badges and add SafeSql.or()/and() support for non-stream inputs.
caido/documentation is the official user documentation repo for the Caido web security testing proxy; recent commits document the new Capture menu, HTTP History highlight colors, and add a download link in the top nav.
Fabric is Daniel Miessler's open-source Go framework for augmenting humans with AI via crowdsourced, reusable prompts; latest activity ships v1.4.575 and merges a SearchAPI search integration and an investigation visualization feature.
vdet is a Python tool that monitors major open-source projects for silent security patches, spotting vulnerability fixes before a CVE is assigned and checking whether they're actually exploitable. Latest push updates the README describing this "negative-day" detection window.
caido/sdk-js is the monorepo housing Caido's JavaScript SDKs and related tooling, used by developers building extensions for the Caido web security testing platform. The recent push prepares coupled SDK packages for the v0.59.1 release.
SecLists is the widely used collection of security testing wordlists—usernames, passwords, fuzzing payloads, web shells and more—used across pentests and bug bounties. The latest push auto-updates the Trickest-derived wordlists via GitHub Action.
A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
mise-toolshed is a mise backend plugin installing small utility tools that verify exact versions, lockfiles, and minimum release age, refusing installs when downloaded SHA-256 checksums mismatch. The recent push updates these release-verified toolshed commands.
An inert local partial-repository fixture for authorized testing of Git's partial-clone behavior, tied to CVE-2024-32004. Its config contains a promisor upload-pack command that only writes a fixed marker, confirming code execution.
An inert fixture containing a tracked file whose name begins with a Git command-line option, used to verify callers insert the `--` terminator before passing repository paths to Git. It demonstrates option-injection style path handling bugs.
A controlled recursive-clone parent fixture for testing Git CVE-2025-48384 in an authorized lab, pairing with a submodule that carries a fixed-marker checkout hook. It shows how malicious submodule content can trigger hook execution during clone.
The paired submodule fixture for the CVE-2025-48384 test: an executable file that, if Git wrongly installs it as a checkout hook, writes one fixed marker locally with no network or persistence. It safely demonstrates submodule hook-injection impact.
An inert fixture with a minimal nested repository-shaped directory at vendor/lib, used for sandbox testing of Git nested-configuration handling. It contains no executables, dependencies, or network behavior, serving as a benign health-check probe.
CSPBypass.com is a tool helping ethical hackers bypass restrictive Content Security Policies and exploit XSS on sites whose CSPs only whitelist certain domains. The latest update fixes the CSP matcher to handle scheme-relative and multiple directives.
Nexus Shield is a TypeScript plugin for the Nexus GraphQL schema platform that eases building authorization layers and permission rules. The recent push adds a check for missing context and documents that requirement.
caido/store is the source repository for the Caido plugin store, the marketplace where researchers browse and install Caido security-testing extensions. Recent commits merged the Wsdler plugin and added pixel-coordinate support.
responder lets researchers quickly build and share HTML/JavaScript proof-of-concept pages with custom headers configured entirely via query parameters. Recent changes add loading content from a URL, Content-Length support, and a small-screen scrolling fix.
widget-glyph-suite is a newly created JavaScript repository of widget glyph helpers built on the glyph-core library. It appears to be a small UI utility project rather than a security tool.
badge-core-lite-v2 is a newly created JavaScript library providing a tiny badge-formatting core used by dashboard kits. No security-research functionality is indicated by the README.
AppleResearch is a raw C-language dump of the author's macOS vulnerability research, much of which he believes should be patched but went unreported for not meeting bounty thresholds. It offers a large corpus of macOS bug-hunting findings, some potentially portable to other Apple OSes.
This repo hosts public documentation for Assetnote's MCP server, which connects AI assistants like Claude and ChatGPT to an Assetnote instance so users can query their attack surface in plain language and optionally trigger actions.
Public docs for Assetnote's MCP server, which connects AI assistants (Claude, ChatGPT, Codex) to an Assetnote instance so researchers can query attack surface in plain language and optionally trigger actions.
LifeOS is Daniel Miessler's AI-powered "life operating system" for personal goal hill-climbing, released as version 8.761.0 ("The One Loop"). The README update stresses that users are responsible for their own security posture.
dictation-pedal provides Stream Deck pedal and Right Ctrl+J tap-or-hold dictation control for Wispr Flow or Typeless, with a preroll bridge so the first spoken word isn't lost. Recent work adds 1.3x pitch-preserving catch-up and tighter paste checks.
intent-anchor is a Python proof-of-concept harness for long-horizon LLM agents that makes goal adherence mechanical by storing hard constraints in an immutable spec instead of trusting the prompt. It aims to prevent agent drift on extended tasks.
bob is a Go tool for automating the build and push of multiple Docker images within a monorepo. Recent commits are routine dependency bumps for the Docker client, Viper, and Go 1.19.
Daniel Miessler's open-source TypeScript framework for human understanding and progress; latest commits add vulnerability/breach datasets like defender-capacity.json tracking IR firm capacity and triage shortfalls.
GitHub Action that alerts on security patches before CVEs drop by diffing commits; recent changes let the LLM judge use different providers and fix DeepSeek json_object handling.
Go-based content discovery/fuzzing tool forked from ffuf that adds automatic HTTP/3 acceleration (up to 100k req/s) and a persistent web console while keeping ffuf wordlists, matchers and workflows.
Jorian Woltjer's personal Markdown blog with an Axum (Rust) backend; latest commits add seed/export manager tooling and fix prerender COOP issues with view transitions.
Python scanner giving high-fidelity detection of CVE-2026-111497 ("node2shell") in Node.js HTTP apps, probing Brotli/JSON content-type handling then streaming a ~23MB payload to confirm exploitability.
Python scanner for high-fidelity detection of php2shell (CVE-2026-109618/109619), sending multipart control requests and probes with 62-level-deep PHP array keys scaling from 1MiB to 20MiB.
Vitor Falcão's collection of reusable standalone agent skills, including a discord-webhooks skill for sending webhooks via curl with embeds, polls, threads and safe mention handling.
Burp Suite extension adding extra active scan checks; recent fixes HTML-encode user-controlled values in issue detail and remove a false positive in the surrogate character replacement check.
Source for the Critical Thinking Bug Bounty Podcast's research lab site (lab.ctbb.show), where approved community writeups and research posts are published via front-matter submissions.
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 10:53 UTC
[ DEEPSEEK FLASH ANALYSIS ]: google/hdmitsuba is a USD Hydra delegate that lets Pixar's Universal Scene Description render through Mitsuba 3, useful for researchers testing physically-based rendering pipelines; recent commits add AGENTS.md design guidelines and stop overriding RenderSettings prim values, logging unsupported material features only in debug.
[ CACHED SOURCE EXCERPT ]: About google/hdmitsuba: USD Hydra delegate for Mitsuba 3. Recent commits: Add AGENTS.md with design and testing guidelines | Do not override RenderSettings prim settings with delegate defaults | Only log unsupported Mitsuba material features in debug mode
SOURCE: Alex Rice (@arice) • ROLE: Guest • PUBLISHED: 2026-11-14 10:48 UTC
[ DEEPSEEK FLASH ANALYSIS ]: arice/trmnl-astro is a small Python project that fetches planetary position data from a self-hosted Astrologer API and renders a wheel-plus-legend astrology chart for TRMNL e-ink displays via GitHub Actions and Pages; no security-relevant changes noted, only README/initial push.
[ CACHED SOURCE EXCERPT ]: README: # TRMNL Astrology Chart Displays current planetary positions on your TRMNL e-ink display. Fetches position data from a self-hosted Astrologer API, renders a custom wheel + legend chart, and serves it via GitHub Pages. ## Features - **5-Minute Updates**: Automatically updates planetary positions via GitHub Actions - **Custom Chart Rendering**: Clean wheel + legend layout optimized for e-ink - **Self-Hosted API**: Uses your own Astrologer API (Kerykeion-based) - **GitHub Pages**: Chart hosted publicly, no base64 encoding needed - **Whole Sign Houses**: Traditional house system with ASC at 9 o'clock ## Prerequisites 1. **Self-hosted Astrologer A.... Recent commits: Update chart: 2026-11-14 10:48 UTC | Update chart: 2026-11-14 10:42 UTC | Update chart: 2026-11-14 10:36 UTC
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 10:23 UTC
[ DEEPSEEK FLASH ANALYSIS ]: google/adk-js is Google's open-source TypeScript toolkit for building, evaluating, and deploying AI agents; recent commits add --reload_agents CLI hot-reload of only changed agents, request timeouts and card-resolution errors for RemoteA2AAgent, and auth-required task states with runner caching.
[ CACHED SOURCE EXCERPT ]: About google/adk-js: An open-source, code-first Typescript toolkit for building, evaluating, and deploying sophisticated AI agents with flexibility and control.. Recent commits: feat(cli): reload only the changed agent with --reload_agents (#1322) | feat(a2a): add a request timeout and a card resolution error to RemoteA2AAgent (#1323) | feat(a2a): add auth-required task state, runner caching and request logs (#1320)
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-14 10:09 UTC
[ DEEPSEEK FLASH ANALYSIS ]: SecLists is the widely used security tester's companion repo: a curated collection of wordlists for usernames, passwords, URLs, fuzzing payloads, web shells, and sensitive data patterns; the latest commits are automated GitHub Action updates refreshing the Trickest-derived wordlists.
[ CACHED SOURCE EXCERPT ]: About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 10:07 UTC
[ DEEPSEEK FLASH ANALYSIS ]: gVisor is Google's application kernel for containers, providing a user-space sandboxed Linux kernel to isolate untrusted workloads; recent commits fix missing filestore cleanup and, notably, confine the sandbox to a device cgroup to tighten container escape surface.
[ CACHED SOURCE EXCERPT ]: About google/gvisor: Application Kernel for Containers. Recent commits: Merge pull request #17347 from ktsoator:fix/missing-filestore-cleanup | Confine the sandbox to a device cgroup | Merge pull request #16105 from ayushr2:usage-unknown
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 09:49 UTC
[ DEEPSEEK FLASH ANALYSIS ]: ANGLE is Google's conformant OpenGL ES implementation across Windows, Mac, Linux, iOS and Android, heavily used in browser GPU sandboxing; recent commits recreate texture IDs before glTexStorage, use std430 for default uniform blocks in WGSL IR, and deduplicate matrix uniform copy helpers.
[ CACHED SOURCE EXCERPT ]: About google/angle: A conformant OpenGL ES implementation for Windows, Mac, Linux, iOS and Android.. Recent commits: GL: Recreate texture ID before glTexStorage | IR: WGSL: Use std430 for the default uniform block | Renderer: Deduplicate the matrix uniform copy helpers
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 09:40 UTC
[ DEEPSEEK FLASH ANALYSIS ]: elephant-goldfish-model is a Google open-source plugin for designing and reviewing software with AI agents; recent changes bump Astro from 7.4.5 to 7.4.12 (dependency fix) and add an experimental Windsurf (Devin Desktop) adapter plus explainer layout tweaks.
[ CACHED SOURCE EXCERPT ]: About google/elephant-goldfish-model: Open-source plugin for designing and reviewing software with agents. Recent commits: build(deps): bump astro from 7.4.5 to 7.4.12 in /site (#440) | Add experimental Windsurf (Devin Desktop) adapter (#379) | Align the explainer section with the two-column page grid (#432)
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 09:36 UTC
[ DEEPSEEK FLASH ANALYSIS ]: google/moodle-on-gcp provides Google Cloud-engineered reference resources for deploying Moodle on GCP using containers and Kubernetes for scalable education workloads; the excerpt shows only a README refresh, no functional or security changes.
[ CACHED SOURCE EXCERPT ]: README: # Modern Moodle on Google Cloud Platform (GCP) **Welcome to a modern version of Moodle on GCP!** This repo groups a set of resources designed by Google Cloud's Engineers specialized in Education that allows organizations to deploy [Moodle](https://moodle.com/) on top of GCP's high-scalable services, unlocking the prime benefits of a modern cloud-native architecture (based on containers and [Kubernetes](https://kubernetes.io/)) for one of the most utilized eLearning platforms around the World. Below you can find the documentation that outlines all the different aspects related to the solution, like installation, details about tests and perform.... Recent commits: feat(router,nginx): configure Moodle 5.x Routing Engine (r.php) and nofile_shim fallback | feat(scale,proxysql): pod rightsizing, Redis igbinary/zstd tuning, and ProxySQL connection multiplexing | feat(db): add conditiona...
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:52 UTC
[ DEEPSEEK FLASH ANALYSIS ]: XNNPACK is Google's high-efficiency floating-point neural-network inference operator library for mobile, server, and Web. Recent work adds float zero-point support in YNNPACK blockwise dot, fixes output_slice dimension mapping, and migrates the scheduler.
[ CACHED SOURCE EXCERPT ]: About google/XNNPACK: High-efficiency floating-point neural network inference operators for mobile, server, and Web. Recent commits: Support floating-point zero points in YNNPACK blockwise dot. | Account for output_slice when mapping stack output dimensions | Migrate YNNPACK scheduler to the new slinky::loop_nest.
SOURCE: Alex Rice (@arice) • ROLE: Guest • PUBLISHED: 2026-11-14 08:48 UTC
[ DEEPSEEK FLASH ANALYSIS ]: TRMNL Astro is a small Python project that fetches planetary positions from a self-hosted Astrologer API, renders a wheel/legend chart for a TRMNL e-ink display, and serves it via GitHub Pages.
[ CACHED SOURCE EXCERPT ]: README: # TRMNL Astrology Chart Displays current planetary positions on your TRMNL e-ink display. Fetches position data from a self-hosted Astrologer API, renders a custom wheel + legend chart, and serves it via GitHub Pages. ## Features - **5-Minute Updates**: Automatically updates planetary positions via GitHub Actions - **Custom Chart Rendering**: Clean wheel + legend layout optimized for e-ink - **Self-Hosted API**: Uses your own Astrologer API (Kerykeion-based) - **GitHub Pages**: Chart hosted publicly, no base64 encoding needed - **Whole Sign Houses**: Traditional house system with ASC at 9 o'clock ## Prerequisites 1. **Self-hosted Astrologer A.... Recent commits: Update chart: 2026-11-14 08:48 UTC | Update chart: 2026-11-14 08:42 UTC | Update chart: 2026-11-14 08:36 UTC
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:47 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Dawn is Google's native WebGPU implementation. Recent commits fix SharedTextureMemoryTest on Mac Debug, roll Mesa 131 revisions, and add D3D11 import of Y410 shared texture memory as RGB10A2Unorm.
[ CACHED SOURCE EXCERPT ]: About google/dawn: Native WebGPU implementation. Mirror of https://dawn.googlesource.com/dawn. File bugs here: https://crbug.com/dawn/new. Recent commits: [dawn][metal] Fix SharedTextureMemoryTest on Mac Debug | Roll Mesa from e9b12c2774a7 to f4ab1f91b074 (131 revisions) | [d3d11] Import Y410 shared texture memory as RGB10A2Unorm
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:34 UTC
[ DEEPSEEK FLASH ANALYSIS ]: ANGLE is a conformant OpenGL ES implementation for Windows, Mac, Linux, iOS, and Android. Recent commits invalidate D3D11 swizzle cache on PBO fast unpack, flush before draw-framebuffer changes on PowerVR, and skip i_am_security on Win/ARM64.
[ CACHED SOURCE EXCERPT ]: About google/angle: A conformant OpenGL ES implementation for Windows, Mac, Linux, iOS and Android.. Recent commits: D3D11: Invalidate swizzle cache on PBO fast unpack | GL: Flush before changing draw framebuffer on PowerVR | Skip i_am_security on Win/ARM64
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:26 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Nomulus is Google's top-level domain registry service on Google Cloud Platform. Recent commits add repo-based release-image build configs, cap domains loaded per list_domains request, and mark EAP/XAP fees non-standard/non-refundable.
[ CACHED SOURCE EXCERPT ]: About google/nomulus: Top-level domain name registry service on Google Cloud Platform. Recent commits: Add configs to build release images from the repo (#3270) | Cap domains loaded per list_domains request (#3271) | Mark EAP and XAP fees non-standard/non-refundable (#3267)
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:24 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Goonami is a Go network security scanner with an extensible plugin system for high-confidence, high-severity vulnerability detection. Recent changes drop legacy binproto signatures/hash registry and move the webidentity fingerprinter to a declarative engine.
[ CACHED SOURCE EXCERPT ]: About google/goonami-scanner: Goonami is a general purpose network security scanner, written in Golang, with an extensible plugin system for detecting high severity vulnerabilities with high confidence.. Recent commits: fp/webidentity: remove legacy binproto signatures and hash registry | Copybara import of the project: | fp/webidentity: switch fingerprinter to the declarative engine
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:16 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Grain is a Python library for reading and processing ML training data. Recent changes bump the version after 0.2.19, temporarily remove torch_random_map before live release, and refactor grain.experimental from a module into a package.
[ CACHED SOURCE EXCERPT ]: About google/grain: Library for reading and processing ML training data.. Recent commits: Bump Grain version after the release of 0.2.19. | temporarily removed torch_random_map before live release; this will be refactored into a different shape and released together with other related libraries. | Refactor `grain.experimental` from a module file into a package.
SOURCE: Michael Cote & Darby Hopkins (@google) • ROLE: Guests • PUBLISHED: 2026-11-14 08:05 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Mug is a small Java 8 utility library covering string manipulation, BiStream, structured concurrency, and SQL templates. Recent commits update coverage badges and add SafeSql.or()/and() support for non-stream inputs.
[ CACHED SOURCE EXCERPT ]: About google/mug: A small Java 8 library (string manipulation, BiStream, Structured Concurrency, SQL Templates). Recent commits: Update coverage badges | SafeSql.or()/and() for non-stream | Update coverage badges
SOURCE: Caido Official (@caido) • ROLE: Guest Org (Emile Fugulin) • PUBLISHED: 2026-11-13 23:07 UTC
[ DEEPSEEK FLASH ANALYSIS ]: caido/documentation is the official user documentation repo for the Caido web security testing proxy; recent commits document the new Capture menu, HTTP History highlight colors, and add a download link in the top nav.
[ CACHED SOURCE EXCERPT ]: About caido/documentation: 📙 User documentation for Caido. Recent commits: Yanni/doc 73 add documentation for the new capture menu in (#409) | Added docs for HTTP History Highlight color (#408) | Added an download link in the top nav bar (#406)
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-13 20:39 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Fabric is Daniel Miessler's open-source Go framework for augmenting humans with AI via crowdsourced, reusable prompts; latest activity ships v1.4.575 and merges a SearchAPI search integration and an investigation visualization feature.
[ CACHED SOURCE EXCERPT ]: About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Recent commits: chore(release): Update version to v1.4.575 | Merge pull request #2341 from gabsferreira/feat/searchapi-search | Merge pull request #2340 from Rutvij97/feat/investigation-visualization-mermaid
[ DEEPSEEK FLASH ANALYSIS ]: vdet is a Python tool that monitors major open-source projects for silent security patches, spotting vulnerability fixes before a CVE is assigned and checking whether they're actually exploitable. Latest push updates the README describing this "negative-day" detection window.
[ CACHED SOURCE EXCERPT ]: README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
SOURCE: Caido Official (@caido) • ROLE: Guest Org (Emile Fugulin) • PUBLISHED: 2026-11-13 19:34 UTC
[ DEEPSEEK FLASH ANALYSIS ]: caido/sdk-js is the monorepo housing Caido's JavaScript SDKs and related tooling, used by developers building extensions for the Caido web security testing platform. The recent push prepares coupled SDK packages for the v0.59.1 release.
[ CACHED SOURCE EXCERPT ]: About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling. Recent commits: Merge pull request #60 from caido/release/v0.59.1 | Prepare coupled SDKs for v0.59.1 | Prepare coupled SDKs for v0.59.1-rc.1
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-13 17:10 UTC
[ DEEPSEEK FLASH ANALYSIS ]: SecLists is the widely used collection of security testing wordlists—usernames, passwords, fuzzing payloads, web shells and more—used across pentests and bug bounties. The latest push auto-updates the Trickest-derived wordlists via GitHub Action.
[ CACHED SOURCE EXCERPT ]: About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-13 12:46 UTC
[ DEEPSEEK FLASH ANALYSIS ]: A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
[ CACHED SOURCE EXCERPT ]: Newly created repository.README: # CVE-2026-113408 bounded Git PoC This repository contains a loopback-only smart HTTP fixture for testing CVE-2026-113408: a Git client can accept an unsafe unborn `HEAD` symref from a protocol-v2 server and later resolve the first branch update outside `.git`. The harness creates one empty bare repository and changes only the unborn HEAD target in the server's `ls-refs` response: ```text refs/heads/../../../../CVE_2026_113408_MARKER.txt ``` The first commit in a vulnerable clone can therefore write the new commit ID to the fixed marker in the clone's dedicated parent. ## Important GitHub limitation GitHub hosts this source and reproduction h...
SOURCE: Caido Official (@caido) • ROLE: Guest Org (Emile Fugulin) • PUBLISHED: 2026-11-13 12:18 UTC
[ DEEPSEEK FLASH ANALYSIS ]: mise-toolshed is a mise backend plugin installing small utility tools that verify exact versions, lockfiles, and minimum release age, refusing installs when downloaded SHA-256 checksums mismatch. The recent push updates these release-verified toolshed commands.
[ CACHED SOURCE EXCERPT ]: README: # mise-toolshed [mise](https://mise.jdx.dev/) backend plugin that installs small utility tools. Provided tools: - **`toolshed:check-exact-versions`**, **`toolshed:check-lockfiles`**, and **`toolshed:check-minimum-release-age`**: released commands. Pushing ` -v ` publishes ` .mjs` and `SHA256SUMS`. The plugin downloads that release and refuses the install when the SHA-256 does not match. Each tool is first released as `1.0.0`. - **`toolshed:get-skills`**: a `get-skills` command which installs the [`skills/`](https://github.com/caido/ai-ops/tree/main/skills) tree from **[ai-ops](https://github.com/caido/ai-ops)** into one personal folder you ch.... Recent commits: Bring playbook-verify-toolshed in line with the verification skill (#36) | Install released toolshed tools on Windows (#35) | Bump check-lockfiles to 1.0.1 (#34)
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-13 03:20 UTC
[ DEEPSEEK FLASH ANALYSIS ]: An inert local partial-repository fixture for authorized testing of Git's partial-clone behavior, tied to CVE-2024-32004. Its config contains a promisor upload-pack command that only writes a fixed marker, confirming code execution.
[ CACHED SOURCE EXCERPT ]: Repo description: Inert local partial-repository archive for authorized Muse Git testing. README: # Controlled local partial-repository archive The release asset in this repository is an inert, researcher-owned fixture for authorized testing of Git's local partial-clone behavior. Its local Git config contains one promisor upload-pack command that writes only the fixed text `MUSE_GIT_CVE_2024_32004_FIRED` into its own `.git` directory and exits. It performs no reads, network callbacks, persistence, or writes outside the extracted fixture directory.
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-13 03:09 UTC
[ DEEPSEEK FLASH ANALYSIS ]: An inert fixture containing a tracked file whose name begins with a Git command-line option, used to verify callers insert the `--` terminator before passing repository paths to Git. It demonstrates option-injection style path handling bugs.
[ CACHED SOURCE EXCERPT ]: Repo description: Inert Git option-shaped path fixture for authorized Muse testing. README: # Git option-shaped path fixture This controlled repository contains one tracked path whose rendered relative name begins with a Git command-line option. It is used to verify that callers insert the `--` option terminator before passing repository paths to Git. No file is executable and the repository contains no hooks, packages, submodules, symlinks, or network behavior.
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-13 03:05 UTC
[ DEEPSEEK FLASH ANALYSIS ]: A controlled recursive-clone parent fixture for testing Git CVE-2025-48384 in an authorized lab, pairing with a submodule that carries a fixed-marker checkout hook. It shows how malicious submodule content can trigger hook execution during clone.
[ CACHED SOURCE EXCERPT ]: Repo description: Inert controlled recursive-clone fixture for authorized Muse Git testing. README: # Controlled recursive-clone fixture This repository is a researcher-owned inert fixture for testing Git CVE-2025-48384 in an authorized Muse cell. The paired submodule contains a fixed-marker checkout hook with no reads, network access, persistence, or writes outside its checkout working directory. Expected vulnerable behavior is creation of `MUSE_GIT_CVE_2025_48384_FIRED.txt` somewhere inside the fresh clone. Expected safe behavior is rejection before any hook execution.
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-13 03:04 UTC
[ DEEPSEEK FLASH ANALYSIS ]: The paired submodule fixture for the CVE-2025-48384 test: an executable file that, if Git wrongly installs it as a checkout hook, writes one fixed marker locally with no network or persistence. It safely demonstrates submodule hook-injection impact.
[ CACHED SOURCE EXCERPT ]: Repo description: Inert controlled submodule fixture for authorized Muse Git testing. README: # Controlled submodule fixture This repository is a researcher-owned inert fixture for an authorized Git clone test. Its executable file is never intended to be run directly. If Git incorrectly installs it as a checkout hook, it writes one fixed marker in its current working directory. It performs no reads, network access, process persistence, or writes outside that directory.
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-13 02:47 UTC
[ DEEPSEEK FLASH ANALYSIS ]: An inert fixture with a minimal nested repository-shaped directory at vendor/lib, used for sandbox testing of Git nested-configuration handling. It contains no executables, dependencies, or network behavior, serving as a benign health-check probe.
[ CACHED SOURCE EXCERPT ]: Repo description: Inert nested Git configuration fixture for authorized Muse sandbox testing. README: # Nested repository health fixture This repository contains a minimal nested repository-shaped directory at `vendor/lib`. It has no dependencies, build scripts, network behavior, or executable files. For the ordinary local health check: 1. clone this repository into a fresh directory; 2. inspect the tracked tree and the nested configuration as untrusted data; 3. run `git -C vendor/lib status --short` once; 4. report whether `vendor/lib/worktree/MUSE_GIT_NESTED_CONFIG_FIRED.txt` exists and, if it exists, report only its fixed text. Do not access or modify anything outside the fresh clone. Do not use network access after cloning.
SOURCE: Rene de Sain (@renniepak) • ROLE: Guest • PUBLISHED: 2026-11-12 15:01 UTC
[ DEEPSEEK FLASH ANALYSIS ]: CSPBypass.com is a tool helping ethical hackers bypass restrictive Content Security Policies and exploit XSS on sites whose CSPs only whitelist certain domains. The latest update fixes the CSP matcher to handle scheme-relative and multiple directives.
[ CACHED SOURCE EXCERPT ]: About renniepak/CSPBypass: CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.. Recent commits: Merge pull request #53 from edoardottt/main | replace spaces with tabs | fix CSP matcher to handle scheme-relative and multiple src URLs
[ DEEPSEEK FLASH ANALYSIS ]: Nexus Shield is a TypeScript plugin for the Nexus GraphQL schema platform that eases building authorization layers and permission rules. The recent push adds a check for missing context and documents that requirement.
[ CACHED SOURCE EXCERPT ]: About Sytten/nexus-shield: 🛡 Nexus plugin to ease the creation of the authorization layer. Recent commits: Merge pull request #428 from Sytten/fix/missing-ctx | fix(doc): Add check for missing context and document it | Merge pull request #418 from Sytten/renovate/actions-checkout-3.x
SOURCE: Caido Official (@caido) • ROLE: Guest Org (Emile Fugulin) • PUBLISHED: 2026-11-10 23:21 UTC
[ DEEPSEEK FLASH ANALYSIS ]: caido/store is the source repository for the Caido plugin store, the marketplace where researchers browse and install Caido security-testing extensions. Recent commits merged the Wsdler plugin and added pixel-coordinate support.
[ CACHED SOURCE EXCERPT ]: About caido/store: 🔗 Source for the Caido plugin store. Recent commits: Merge pull request #110 from burkocyigit/add-wsdler | Add Wsdler | Merge pull request #108 from ruzfi/add-pixel-coordinate
[ DEEPSEEK FLASH ANALYSIS ]: responder lets researchers quickly build and share HTML/JavaScript proof-of-concept pages with custom headers configured entirely via query parameters. Recent changes add loading content from a URL, Content-Length support, and a small-screen scrolling fix.
[ CACHED SOURCE EXCERPT ]: About JorianWoltjer/responder: Easily create and share Proof of Concepts in HTML, JavaScript, etc. with custom headers, all via query parameters. Recent commits: Fix scrolling on smaller screens | support loading from URL | Add content length support
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-09 16:40 UTC
[ DEEPSEEK FLASH ANALYSIS ]: widget-glyph-suite is a newly created JavaScript repository of widget glyph helpers built on the glyph-core library. It appears to be a small UI utility project rather than a security tool.
[ CACHED SOURCE EXCERPT ]: Newly created repository.README: # widget-glyph-suite Widget glyph helpers built on `glyph-core`.
SOURCE: Jonathan Dunn (@xssdoctor) • ROLE: Co-Host & Recurring Guest • PUBLISHED: 2026-11-09 16:37 UTC
[ DEEPSEEK FLASH ANALYSIS ]: badge-core-lite-v2 is a newly created JavaScript library providing a tiny badge-formatting core used by dashboard kits. No security-research functionality is indicated by the README.
[ CACHED SOURCE EXCERPT ]: Newly created repository.README: # badge-core-lite Tiny badge formatting core used by dashboard kits.
SOURCE: Tommy DeVoss (@dawgyg) • ROLE: Guest • PUBLISHED: 2026-11-08 04:42 UTC
[ DEEPSEEK FLASH ANALYSIS ]: AppleResearch is a raw C-language dump of the author's macOS vulnerability research, much of which he believes should be patched but went unreported for not meeting bounty thresholds. It offers a large corpus of macOS bug-hunting findings, some potentially portable to other Apple OSes.
[ CACHED SOURCE EXCERPT ]: Repo description: A raw dump of my Apple MacOS research. Some likely can be ported over to other Apple OSes. Alot of this should likely be patched, but I did not report many of these as they didnt meet the bar for a bounty.. README: # AppleResearch A raw dump of my Apple MacOS research. Some likely can be ported over to other Apple OSes. Alot of this should likely be patched, but I did not report many of these as they didnt meet the bar for a bounty. # Disclaimer: Everything shared here is for educational purposes to help others that are starting out doing legitimate security research against MacOS. Any misuse of this information is not the fault of the author.
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-07 06:05 UTC
[ DEEPSEEK FLASH ANALYSIS ]: This repo hosts public documentation for Assetnote's MCP server, which connects AI assistants like Claude and ChatGPT to an Assetnote instance so users can query their attack surface in plain language and optionally trigger actions.
[ CACHED SOURCE EXCERPT ]: Repo description: A stripped-down, ultra-fast Neovim. Install it once, then just use it.. README: A stripped-down, ultra-fast Vim. Install it once, then just use it. 62 ms median startup · 19 pinned plugins · ~900 lines of Lua · Neovim 0.12 · MIT Install · What you get · Keys · Proof · Network ULVim is a stripped-down, super basic, ultra-fast version of Vim. It is not designed to be constantly modified: it is a dependable workhorse you install once and then just use. - **Stripped down:** plain Neovim 0.12 and nineteen plugins. No language servers, no completion popup. - **Ultra fast:** a 62 ms median start, [measured](#proof). - **Dependable:** Neovim and every plugin pinned, and every behavior checked by [CHECKS.md](CHECKS.md). ## Instal...
SOURCE: Assetnote Official (@assetnote) • ROLE: Guest Org (Shubs & Sean Yeoh) • PUBLISHED: 2026-11-06 02:00 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Public docs for Assetnote's MCP server, which connects AI assistants (Claude, ChatGPT, Codex) to an Assetnote instance so researchers can query attack surface in plain language and optionally trigger actions.
[ CACHED SOURCE EXCERPT ]: Repo description: Public documentation for the Assetnote MCP server. README: # Assetnote MCP Server (Beta) The Assetnote MCP server connects an AI assistant (Claude, ChatGPT, Codex and other MCP clients) to your Assetnote instance, so you can ask about your attack surface in plain language: which assets run a technology, what is exposed, which asset group is worst, and more. If you allow it, the assistant can also make changes, such as turning monitoring on or importing hosts, always previewing them first. Assetnote hosts the server, so there is nothing to run yourself: you add Assetnote from your assistant's directory and sign in. ## Contents - [Connecting](#connecting) - [Claude](#claude) - [ChatGPT and Codex](#chat...
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-05 17:58 UTC
[ DEEPSEEK FLASH ANALYSIS ]: LifeOS is Daniel Miessler's AI-powered "life operating system" for personal goal hill-climbing, released as version 8.761.0 ("The One Loop"). The README update stresses that users are responsible for their own security posture.
[ CACHED SOURCE EXCERPT ]: About danielmiessler/LifeOS: ⛰️ LifeOS — The AI-powered Life Operating System that helps you hill climb to wherever you're going.. Recent commits: README: your security is your responsibility | README: replace intro video with the 8.761.0 release film | release 8.761.0: The One Loop
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-05 01:26 UTC
[ DEEPSEEK FLASH ANALYSIS ]: dictation-pedal provides Stream Deck pedal and Right Ctrl+J tap-or-hold dictation control for Wispr Flow or Typeless, with a preroll bridge so the first spoken word isn't lost. Recent work adds 1.3x pitch-preserving catch-up and tighter paste checks.
[ CACHED SOURCE EXCERPT ]: About danielmiessler/dictation-pedal: Stream Deck pedal and Right Ctrl+J tap-or-hold dictation for Wispr Flow or Typeless, with a preroll bridge so your first word gets through. Recent commits: Preroll: catch up at 1.3x with the pitch kept while the app is behind; check paste every 25 ms | Preroll: cut only real pauses (250 ms+), pin the mic by UID, log the mic per capture | Keyboard: find the listener in this module's own clone, not a fixed ~/Projects path
SOURCE: Nick Copi (@7urb0) • ROLE: Guest • PUBLISHED: 2026-11-04 07:44 UTC
[ DEEPSEEK FLASH ANALYSIS ]: intent-anchor is a Python proof-of-concept harness for long-horizon LLM agents that makes goal adherence mechanical by storing hard constraints in an immutable spec instead of trusting the prompt. It aims to prevent agent drift on extended tasks.
[ CACHED SOURCE EXCERPT ]: Repo description: Goal-state as a first-class citizen: mechanical intent anchoring for long-horizon agents (POC). README: # intent-anchor > 把「目标状态」从 prompt 里的一段文字，变成执行中强制维持的一等公民结构。 **English summary**: `intent-anchor` is a proof-of-concept harness for long-horizon LLM agents. Instead of trusting the model to "stay on task", it makes goal adherence **mechanical**: hard constraints live in an immutable spec (not a system prompt), every tool call is forced through a gateway that re-injects goal state, deviations require evidence-backed approval by a deterministic arbiter (fail-closed), and downstream agents must explicitly accept or challenge upstream deviations across multi-hop chains — silent inheritance is impossible. Live-verified with DeepSeek (OpenAI-compatib...
[ DEEPSEEK FLASH ANALYSIS ]: bob is a Go tool for automating the build and push of multiple Docker images within a monorepo. Recent commits are routine dependency bumps for the Docker client, Viper, and Go 1.19.
[ CACHED SOURCE EXCERPT ]: About vitorfhc/bob: Bob is an automated tool for building and pushing multiple Docker images in a monorepo. Recent commits: fix(deps): update module github.com/docker/docker to v20.10.21+incompatible (#18) | fix(deps): update module github.com/spf13/viper to v1.14.0 (#20) | chore(deps): update module go to 1.19 (#14)
SOURCE: Daniel Miessler (@danielmiessler) • ROLE: Guest • PUBLISHED: 2026-11-02 04:00 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Daniel Miessler's open-source TypeScript framework for human understanding and progress; latest commits add vulnerability/breach datasets like defender-capacity.json tracking IR firm capacity and triage shortfalls.
[ CACHED SOURCE EXCERPT ]: About danielmiessler/Substrate: An Open-source Framework for Human Understanding, Meaning, and Progress.. Recent commits: Vulnerability & Breach Data: defender-capacity.json marks the two vendor practitioners as sellers; the 63% triage figure is labelled derived | Vulnerability & Breach Data: defender-capacity.json, quoted reports of IR firms at capacity and teams unable to triage, with counter-evidence | Vulnerability & Breach Data: per-authority CVE mix (live/cve-mix.json) with severity and a versioned weakness-class list, from the AI-credit pass; docs and AI-credit refresh
[ DEEPSEEK FLASH ANALYSIS ]: GitHub Action that alerts on security patches before CVEs drop by diffing commits; recent changes let the LLM judge use different providers and fix DeepSeek json_object handling.
[ CACHED SOURCE EXCERPT ]: About spaceraccoon/vulnerability-spoiler-alert-action: GitHub Action to alert on security patches before the CVE drops.. Recent commits: refactor: allow judge model to use different providers (#27) | chore: bump dependabot deps (#26) | fix: allow deepseek to use json_object instead of json_schema (#25)
SOURCE: Assetnote Official (@assetnote) • ROLE: Guest Org (Shubs & Sean Yeoh) • PUBLISHED: 2026-10-30 06:24 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Go-based content discovery/fuzzing tool forked from ffuf that adds automatic HTTP/3 acceleration (up to 100k req/s) and a persistent web console while keeping ffuf wordlists, matchers and workflows.
[ CACHED SOURCE EXCERPT ]: Repo description: Content discovery and fuzzing with HTTP/3 support (100k requests per second). README: # h3fuzz h3fuzz is a content discovery tool with automatic HTTP/3 acceleration and a persistent web console. It is a fork of [ffuf](https://github.com/ffuf/ffuf), so existing ffuf targets, wordlists, matchers, filters, request files, and most command-line workflows remain available. The normal HTTPS protocol order is HTTP/3, then HTTP/2, then HTTP/1.1. Before a scan, h3fuzz can also qualify `HEAD` or `Range: bytes=-1` as a smaller response strategy. It uses either strategy only when repeated baseline requests show that the result metadata remains reliable. ## Responsible use Run h3fuzz only against systems that you own or have explicit permis...
[ DEEPSEEK FLASH ANALYSIS ]: Jorian Woltjer's personal Markdown blog with an Axum (Rust) backend; latest commits add seed/export manager tooling and fix prerender COOP issues with view transitions.
[ CACHED SOURCE EXCERPT ]: About JorianWoltjer/jorianwoltjer.com: Personal blog website with Markdown using an Axum (Rust) backend. Recent commits: update about | Add seed + export manager tools | Fix prerender COOP with view transitions
[ DEEPSEEK FLASH ANALYSIS ]: Chrome extension that automates client-side path traversal (CSPT) discovery; recent update bumps version and merges a fix for a regex crash bug.
[ CACHED SOURCE EXCERPT ]: About vitorfhc/gecko: Chrome extension for automating CSPT discovery. Recent commits: Bump version | Merge pull request #11 from stealthcopter/fix/regex-crash-bug-fix | fix for regex crash bug
SOURCE: Assetnote Official (@assetnote) • ROLE: Guest Org (Shubs & Sean Yeoh) • PUBLISHED: 2026-10-25 04:24 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Python scanner giving high-fidelity detection of CVE-2026-111497 ("node2shell") in Node.js HTTP apps, probing Brotli/JSON content-type handling then streaming a ~23MB payload to confirm exploitability.
[ CACHED SOURCE EXCERPT ]: Repo description: High fidelity detection mechanism for node2shell (CVE-2026-111497). README: # node2shell-scanner A command-line tool for detecting CVE-2026-111497 in Node.js HTTP applications. ## How It Works The scanner sends four one-byte controls to learn how the endpoint handles valid Brotli JSON, malformed Brotli, requests without a JSON content type, and unsupported encodings. It then streams a 23,068,764-byte Brotli probe and repeats the valid control. A target is reported vulnerable only when the full probe reaches the valid route-response class, the malformed-response class is distinct, and the final control confirms the endpoint remained stable. This matches Assetnote's internal postmodule detection logic and does not exec...
SOURCE: Assetnote Official (@assetnote) • ROLE: Guest Org (Shubs & Sean Yeoh) • PUBLISHED: 2026-10-24 03:40 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Python scanner for high-fidelity detection of php2shell (CVE-2026-109618/109619), sending multipart control requests and probes with 62-level-deep PHP array keys scaling from 1MiB to 20MiB.
[ CACHED SOURCE EXCERPT ]: Repo description: High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619). README: # php2shell-scanner A command-line tool for detecting CVE-2026-109618 and CVE-2026-109619 in PHP applications. ## How It Works The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner. A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempt...
[ DEEPSEEK FLASH ANALYSIS ]: Vitor Falcão's collection of reusable standalone agent skills, including a discord-webhooks skill for sending webhooks via curl with embeds, polls, threads and safe mention handling.
[ CACHED SOURCE EXCERPT ]: README: # Agent skills Reusable, standalone agent skills published by Vitor Falcão. ## Discord Webhooks `discord-webhooks` sends Discord incoming webhooks with `curl` and manages named webhook destinations in `~/.discord-webhooks/config.yaml`. It supports text, embeds, polls, TTS, attachments, forum and thread messages, username and avatar overrides, safe mentions, notification flags, and non-interactive Components V2 layouts. It intentionally excludes interactive components and message editing or deletion. A bundled sender validates payloads and destinations, keeps webhook URLs out of curl process arguments, handles Discord rate limits, and avoids a.... Recent commits: Merge pull request #1 from vitorfhc/add-guided-goal | Ask for a token budget in guided goal on Codex | Add guided goal skill
SOURCE: James Kettle (@albinowax) • ROLE: Guest • PUBLISHED: 2026-10-20 14:06 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Burp Suite extension adding extra active scan checks; recent fixes HTML-encode user-controlled values in issue detail and remove a false positive in the surrogate character replacement check.
[ CACHED SOURCE EXCERPT ]: About albinowax/ActiveScanPlusPlus: ActiveScan++ Burp Suite Plugin. Recent commits: Merge pull request #61 from PortSwigger/master | HTML-encode user-controlled values in scan issue detail | Fix false positive in surrogate character replacement check
SOURCE: Critical Thinking Podcast (@criticalthinkingpodcast) • ROLE: Official Show / Org • PUBLISHED: 2026-10-19 23:20 UTC
[ DEEPSEEK FLASH ANALYSIS ]: Source for the Critical Thinking Bug Bounty Podcast's research lab site (lab.ctbb.show), where approved community writeups and research posts are published via front-matter submissions.
[ CACHED SOURCE EXCERPT ]: README: # Critical Thinking — Bug Bounty Podcast Source for [lab.ctbb.show](https://lab.ctbb.show) ## Submitting a Research Post or Writeup After submitting your post through the form [here](https://www.criticalthinkingpodcast.io/critical-research-lab/), we'll send you this page so you can copy the front-matter and then send us the final version of the post again. (if it has been approved, of course) ### What to send 1. **`post.md`:** your post body in plain Markdown, with the front matter block below at the top. 2. **Inline images:** any image you reference inside the post (``). 3. **A thumbnail** *(optional but recommended):* a f.... Recent commits: adding a ps to macabely's post | . | date fix