https://rootnotes.in/article/operation-lonestar-roundup-eleven-addresses-and-forty-laptop-farms Root Notes en 2026-10-15T11:25:50.227Z The Justice Department published eleven ordinary Gmail addresses and asked employers to go and look https://rootnotes.in/article/ghostaction-30000-repositories-and-the-26-secrets-anyone-has-counted Root Notes en 2026-10-15T11:25:42.646Z GhostAction reached 30,000 repositories in two days. The only wave anyone has measured gave up 26 secrets https://rootnotes.in/article/chrome-full-chain-the-parts-were-priced-at-4500-the-chain-at-250000 Root Notes en 2026-10-15T11:25:34.542Z Google paid $250,000 for a Chrome chain whose three bugs it had separately priced at $4,500 https://rootnotes.in/article/ahsaycbs-the-first-patch-did-not-fix-it-and-the-vendor-said-so Root Notes en 2026-10-15T08:40:41.415Z The first patch did not fix it, the vendor said so, and the working one was behind a partner portal https://rootnotes.in/article/cisco-secure-email-gateway-cve-2026-76519-an-attachment-writes-the-file Root Notes en 2026-10-15T08:40:26.563Z The thing that scans attachments for malware is exploited by an attachment, and it runs as root https://rootnotes.in/article/pan-os-cve-2026-0322-exploited-root-on-the-management-interface Root Notes en 2026-10-15T08:40:06.275Z Palo Alto is patching a second exploited flaw this month, and this one runs as root on the management interface https://rootnotes.in/article/marklogic-31-flaws-and-a-patch-that-removes-access-on-purpose Root Notes en 2026-10-14T12:20:54.459Z Thirty-one flaws, and the patch takes away access people are using today https://rootnotes.in/article/p7-darksword-the-exploit-chain-leaked-and-now-it-arrives-in-an-advert Root Notes en 2026-10-14T12:20:46.168Z The exploit chain was disclosed, the source leaked, and now it arrives in an advert https://rootnotes.in/article/slugfest-npm-trusted-publishing-checked-the-name-not-the-id Root Notes en 2026-10-14T12:20:37.628Z npm checked the repository's name, and a name is something somebody else can claim https://rootnotes.in/article/irhythm-told-the-sec-in-june-and-told-patients-in-october Root Notes en 2026-10-14T09:07:15.008Z The company told the SEC in June and started telling patients in October https://rootnotes.in/article/ivanti-connect-secure-uta0576-a-patched-appliance-and-an-unpatched-link Root Notes en 2026-10-14T06:50:26.086Z The appliance was fully patched when they got in, and one link in the chain still is not fixed https://rootnotes.in/article/patch-tuesday-october-2026-fourteen-hundred-fixes-and-five-totals Root Notes en 2026-10-14T06:50:14.320Z Microsoft shipped more than fourteen hundred fixes, and five vendors counting them got five different numbers