https://rootnotes.in/article/uat-11985-the-kit-relays-the-mfa-prompt-and-keeps-the-session Root Notes en 2026-10-12T09:57:14.565Z The kit sends your password to Google, relays the real prompt back, and keeps the session that comes out https://rootnotes.in/article/cve-2026-0257-five-months-in-the-catalogue-and-still-the-way-in Root Notes en 2026-10-12T09:52:17.276Z The flaw has been in the exploited catalogue since May, and it is still how the ransomware crews are getting in https://rootnotes.in/article/ghostaction-the-workflow-was-tailored-to-the-secrets-each-repository-used Root Notes en 2026-10-12T09:27:08.783Z The workflow was called security-audit.yml, and each copy named the secrets that repository actually used https://rootnotes.in/article/dtu-breach-200000-is-the-size-of-the-database-not-the-victim-count Root Notes en 2026-10-12T09:25:37.812Z The university cannot say what was taken, and will not write to the former students whose CPR numbers it holds https://rootnotes.in/article/ahsaycbs-exploited-three-days-after-disclosure-and-the-safe-version-is-not Root Notes en 2026-10-12T09:25:22.491Z The backup product was being exploited three days after disclosure, and the version called safe is not