https://rootnotes.in/article/matchboil-uac-0099-in-development-a-year-before-anyone-documented-it Root Notes en 2026-10-09T12:58:00.900Z The downloader's compile dates run a year earlier than the first public report of it https://rootnotes.in/article/fakegit-17610-repositories-and-almost-none-of-them-new Root Notes en 2026-10-09T12:57:50.121Z Nobody had to create a single new repository — the operator edited the README on the ones that already existed https://rootnotes.in/article/midnight-mimosa-the-malware-is-in-the-system-partition-before-the-first-boot Root Notes en 2026-10-09T12:34:35.442Z The malware sits in the system partition, which means the first owner was infected before the first boot https://rootnotes.in/article/double-counter-discord-bot-breach-the-server-they-had-already-moved-off Root Notes en 2026-10-09T05:51:25.935Z The breach came through a server the company had already migrated away from, still running an analytics tool https://rootnotes.in/article/firefox-wallet-extensions-the-real-wallet-code-with-one-function-hooked Root Notes en 2026-10-09T05:47:21.022Z Four of the fake wallets were the real wallet's code with the import function hooked https://rootnotes.in/article/sungrow-isolarcloud-cve-2026-107194-one-field-set-to-five-ignores-the-password Root Notes en 2026-10-09T05:41:32.549Z One field set to five logged the researcher in as anyone, and the account owner was never told https://rootnotes.in/article/azazel-gentlemen-mcp-as-a-command-channel-and-the-affiliate-who-kept-the-money Root Notes en 2026-10-08T12:01:52.358Z The ransomware affiliate ran his commands through an AI assistant's tool protocol, then scanned the internet for more of them https://rootnotes.in/article/denmark-cpr-register-8-8-million-looked-up-through-lawful-access Root Notes en 2026-10-08T11:59:31.911Z Nobody broke into Denmark's population register — a company allowed to search it looked up 8.8 million people https://rootnotes.in/article/poellm-canto-incognito-the-c2-address-is-four-words-in-a-poem Root Notes en 2026-10-08T08:36:20.743Z The command server's address is four words in a poem, and moving the botnet means editing the poem https://rootnotes.in/article/kibana-cve-2026-102406-one-tenant-could-claim-anothers-data-stream Root Notes en 2026-10-08T06:15:40.078Z Kibana let one tenant claim another's data stream, and removing the package does not give it back https://rootnotes.in/article/wolfssh-cve-2026-16516-the-host-key-check-passed-on-a-curve-the-attacker-picked Root Notes en 2026-10-08T06:08:21.786Z The host key check ran, and passed, on a curve the attacker chose for it https://rootnotes.in/article/atlassian-cve-2026-21589-two-hours-from-proof-of-concept-to-the-first-attempt Root Notes en 2026-10-08T05:58:47.074Z Two hours passed between the proof of concept going public and the first attempt landing in a honeypot