https://rootnotes.in/article/peerstitch-no-file-no-port-no-outbound-connection Root Notes en 2026-10-16T12:27:44.611Z The FortiGate implant has no file, no port and no outbound connection. It passes notes between two daemons https://rootnotes.in/article/bankruptcy-noticing-center-offline-one-contractor-every-federal-court Root Notes en 2026-10-16T12:27:24.088Z One contractor sends the notices for every federal bankruptcy court, and for mandatory recipients its website is the notice https://rootnotes.in/article/beyondtrust-cve-2026-102764-found-because-another-vendors-breach-went-public Root Notes en 2026-10-16T12:27:14.557Z BeyondTrust found a month-old compromise of its own because a different vendor's breach became public https://rootnotes.in/article/cert-in-ciad-2026-0049-agents-under-evaluation-and-nobody-noticed Root Notes en 2026-10-16T09:30:36.514Z India's CERT says AI labs' own test agents reached live company systems, and not one company noticed https://rootnotes.in/article/adfection-citizen-lab-the-ad-auction-picked-the-target Root Notes en 2026-10-16T09:30:27.141Z Citizen Lab says an ad auction picked the targets, and the advert itself carried no exploit https://rootnotes.in/article/nextjs-out-of-band-the-critical-rces-need-your-config-the-high-does-not Root Notes en 2026-10-16T09:30:02.042Z Next.js shipped two 9.5s out of band. The one most applications are actually exposed to is the 8.2 https://rootnotes.in/article/operation-lonestar-roundup-eleven-addresses-and-forty-laptop-farms Root Notes en 2026-10-15T11:25:50.227Z The Justice Department published eleven ordinary Gmail addresses and asked employers to go and look https://rootnotes.in/article/ghostaction-30000-repositories-and-the-26-secrets-anyone-has-counted Root Notes en 2026-10-15T11:25:42.646Z GhostAction reached 30,000 repositories in two days. The only wave anyone has measured gave up 26 secrets https://rootnotes.in/article/chrome-full-chain-the-parts-were-priced-at-4500-the-chain-at-250000 Root Notes en 2026-10-15T11:25:34.542Z Google paid $250,000 for a Chrome chain whose three bugs it had separately priced at $4,500 https://rootnotes.in/article/ahsaycbs-the-first-patch-did-not-fix-it-and-the-vendor-said-so Root Notes en 2026-10-15T08:40:41.415Z The first patch did not fix it, the vendor said so, and the working one was behind a partner portal https://rootnotes.in/article/cisco-secure-email-gateway-cve-2026-76519-an-attachment-writes-the-file Root Notes en 2026-10-15T08:40:26.563Z The thing that scans attachments for malware is exploited by an attachment, and it runs as root https://rootnotes.in/article/pan-os-cve-2026-0322-exploited-root-on-the-management-interface Root Notes en 2026-10-15T08:40:06.275Z Palo Alto is patching a second exploited flaw this month, and this one runs as root on the management interface