https://rootnotes.in/article/php-both-flaws-sit-in-the-part-every-request-touches Root Notes en 2026-10-23T07:56:39.233Z Both PHP flaws sit in the part every request touches. The Foundation says the fix for one of them stalled for months https://rootnotes.in/article/gitlab-cvss-10-and-the-affected-range-starts-at-7-0 Root Notes en 2026-10-23T06:28:42.439Z GitLab shipped a CVSS 10.0 fix for a flaw that has been in every self-managed version since 7.0 https://rootnotes.in/article/arista-velocloud-the-lowest-role-in-the-product-is-enough Root Notes en 2026-10-23T06:28:08.659Z Arista's VeloCloud flaw needs a login. The lowest one the product offers will do, and the advisory says no setting prevents it https://rootnotes.in/article/php2shell-the-foundation-counted-four-leaks-and-one-came-from-the-finder Root Notes en 2026-10-23T06:27:46.326Z The PHP Foundation's own timeline lists four leaks before the patch. One of them came from the firm credited with finding the flaws https://rootnotes.in/article/litellm-the-provenance-was-signed-and-it-named-the-wrong-repository Root Notes en 2026-10-22T07:33:24.220Z LiteLLM's compromised build shipped with signed provenance. It said the source was a repository one hyphen off the real one https://rootnotes.in/article/sbi-six-hours-to-the-regulator-and-no-duty-to-tell-you-until-2027 Root Notes en 2026-10-22T07:18:48.053Z SBI had six hours to tell two regulators and five days to tell its shareholders. Nothing requires it to tell the customers https://rootnotes.in/article/signal-ringrtc-the-fix-is-seven-weeks-old-and-signal-never-mentioned-it Root Notes en 2026-10-22T07:14:43.897Z Signal fixed this calling flaw on 4 September. The 9.3 score, the CVE and the coverage all arrived six weeks later https://rootnotes.in/article/php2shell-ai-found-them-first-and-then-the-identifiers-leaked Root Notes en 2026-10-22T05:40:33.638Z AI found the PHP flaws before attackers did, the industry got a head start, and a leak of the CVE numbers ended it a day early https://rootnotes.in/article/tor-333-exit-relays-and-the-warning-everybody-clicks-through Root Notes en 2026-10-22T05:40:22.617Z 333 Tor exit relays were rewritten to intercept SSH, and the only thing between you and it was a host-key warning https://rootnotes.in/article/storm-0940-the-loud-half-failed-completely-and-the-quiet-half-worked Root Notes en 2026-10-22T05:39:59.498Z Microsoft says 151,000 password attempts against ConnectWise victims succeeded exactly zero times. The part that worked made no sign-in at all