https://rootnotes.in/article/a-ransom-negotiator-is-charged-and-the-extortion-site-is-the-question Root Notes en 2026-10-24T07:07:13.198Z A ransomware negotiator has been charged with extortion, and investigators suspect the victim site was run from inside the response industry https://rootnotes.in/article/cisco-email-gateway-the-remedy-is-a-new-appliance Root Notes en 2026-10-24T06:40:30.655Z An email with the wrong attachment reaches root on a Cisco mail gateway, and the remedy is a new appliance https://rootnotes.in/article/pingcap-no-database-was-reached-the-queries-about-them-were-taken Root Notes en 2026-10-24T06:40:07.728Z PingCAP says no TiDB database was reached. The export included what customers typed into its SQL editor https://rootnotes.in/article/node2shell-the-brotli-change-was-public-in-february Root Notes en 2026-10-24T06:39:55.364Z Node.js shipped the Brotli fix on Tuesday. Google's own CVE record says the change went public in February https://rootnotes.in/article/sbi-the-records-are-real-and-the-filing-cannot-say-where-they-came-from Root Notes en 2026-10-23T11:54:35.874Z SBI confirmed 3,897 records contain real customer data. Its own filing says it still has to work out where they came from https://rootnotes.in/article/php-both-flaws-sit-in-the-part-every-request-touches Root Notes en 2026-10-23T07:56:39.233Z Both PHP flaws sit in the part every request touches. The Foundation says the fix for one of them stalled for months https://rootnotes.in/article/gitlab-cvss-10-and-the-affected-range-starts-at-7-0 Root Notes en 2026-10-23T06:28:42.439Z GitLab shipped a CVSS 10.0 fix for a flaw that has been in every self-managed version since 7.0 https://rootnotes.in/article/arista-velocloud-the-lowest-role-in-the-product-is-enough Root Notes en 2026-10-23T06:28:08.659Z Arista's VeloCloud flaw needs a login. The lowest one the product offers will do, and the advisory says no setting prevents it https://rootnotes.in/article/php2shell-the-foundation-counted-four-leaks-and-one-came-from-the-finder Root Notes en 2026-10-23T06:27:46.326Z The PHP Foundation's own timeline lists four leaks before the patch. One of them came from the firm credited with finding the flaws