https://rootnotes.in/article/apple-coregraphics-cve-2026-86950-a-targeted-zero-day-with-a-public-proof-of-concept Root Notes en 2026-10-05T12:42:39.212Z Apple's font bug was used against a handful of people, and the proof of concept now crashes any unpatched iPhone https://rootnotes.in/article/pentagon-dmdc-breach-nine-months-of-access-and-data-that-cannot-be-rotated Root Notes en 2026-10-05T12:42:28.616Z Nine months of access to unencrypted Social Security numbers, and the Pentagon says it has no indication of misuse https://rootnotes.in/article/etherhiding-unc5342-the-payload-is-on-chain-and-the-chokepoint-is-the-api-provider Root Notes en 2026-10-05T11:24:53.198Z North Korea put its malware somewhere nobody can take down, and reaches it through a handful of companies that can https://rootnotes.in/article/unsloth-studio-picking-a-model-ran-its-code-and-there-is-no-cve-to-tell-you Root Notes en 2026-10-05T07:14:47.168Z Choosing a model in Unsloth Studio ran that model's code, and because the product was in beta there is no CVE to tell anyone https://rootnotes.in/article/truffle-543699-live-credentials-revocation-not-push-protection-is-what-kills-a-leaked-key Root Notes en 2026-10-05T06:19:32.236Z npm had one live token left out of 101,886. Postgres had 11,465 out of 12,985. The difference is not push protection https://rootnotes.in/article/microsoft-titan-a-token-with-no-signature-and-the-word-admin-reached-seventeen-trillion-rows Root Notes en 2026-10-05T06:18:53.471Z A token with no signature and the word admin in it reached seventeen trillion rows of Microsoft's own data