https://rootnotes.in/article/glassworm-vs-code-themes-ship-executable-code-hidden-in-invisible-unicode Root Notes en 2026-10-06T06:00:31.393Z A colour theme is supposed to be a file of colours; these shipped 59 KB of code on a single line, hidden in invisible characters https://rootnotes.in/article/apple-full-disk-access-controls-ai-agents-a-permission-that-has-to-be-renewed Root Notes en 2026-10-06T06:00:04.215Z Apple is making Full Disk Access something you re-approve, because the thing holding the permission is no longer a tool you operate https://rootnotes.in/article/netscaler-cve-2026-88779-the-reboots-were-not-the-patch-they-were-a-third-zero-day Root Notes en 2026-10-06T05:59:45.119Z The NetScaler appliances restarting after the patch were not a patch bug — they were a third zero-day, and the sixth crash is the trigger https://rootnotes.in/article/apple-coregraphics-cve-2026-86950-a-targeted-zero-day-with-a-public-proof-of-concept Root Notes en 2026-10-05T12:42:39.212Z Apple's font bug was used against a handful of people, and the proof of concept now crashes any unpatched iPhone https://rootnotes.in/article/pentagon-dmdc-breach-nine-months-of-access-and-data-that-cannot-be-rotated Root Notes en 2026-10-05T12:42:28.616Z Nine months of access to unencrypted Social Security numbers, and the Pentagon says it has no indication of misuse https://rootnotes.in/article/etherhiding-unc5342-the-payload-is-on-chain-and-the-chokepoint-is-the-api-provider Root Notes en 2026-10-05T11:24:53.198Z North Korea put its malware somewhere nobody can take down, and reaches it through a handful of companies that can https://rootnotes.in/article/unsloth-studio-picking-a-model-ran-its-code-and-there-is-no-cve-to-tell-you Root Notes en 2026-10-05T07:14:47.168Z Choosing a model in Unsloth Studio ran that model's code, and because the product was in beta there is no CVE to tell anyone https://rootnotes.in/article/truffle-543699-live-credentials-revocation-not-push-protection-is-what-kills-a-leaked-key Root Notes en 2026-10-05T06:19:32.236Z npm had one live token left out of 101,886. Postgres had 11,465 out of 12,985. The difference is not push protection https://rootnotes.in/article/microsoft-titan-a-token-with-no-signature-and-the-word-admin-reached-seventeen-trillion-rows Root Notes en 2026-10-05T06:18:53.471Z A token with no signature and the word admin in it reached seventeen trillion rows of Microsoft's own data