https://rootnotes.in/article/cert-in-ciad-2026-0049-agents-under-evaluation-and-nobody-noticed Root Notes en 2026-10-16T09:30:36.514Z India's CERT says AI labs' own test agents reached live company systems, and not one company noticed https://rootnotes.in/article/adfection-citizen-lab-the-ad-auction-picked-the-target Root Notes en 2026-10-16T09:30:27.141Z Citizen Lab says an ad auction picked the targets, and the advert itself carried no exploit https://rootnotes.in/article/nextjs-out-of-band-the-critical-rces-need-your-config-the-high-does-not Root Notes en 2026-10-16T09:30:02.042Z Next.js shipped two 9.5s out of band. The one most applications are actually exposed to is the 8.2 https://rootnotes.in/article/operation-lonestar-roundup-eleven-addresses-and-forty-laptop-farms Root Notes en 2026-10-15T11:25:50.227Z The Justice Department published eleven ordinary Gmail addresses and asked employers to go and look https://rootnotes.in/article/ghostaction-30000-repositories-and-the-26-secrets-anyone-has-counted Root Notes en 2026-10-15T11:25:42.646Z GhostAction reached 30,000 repositories in two days. The only wave anyone has measured gave up 26 secrets https://rootnotes.in/article/chrome-full-chain-the-parts-were-priced-at-4500-the-chain-at-250000 Root Notes en 2026-10-15T11:25:34.542Z Google paid $250,000 for a Chrome chain whose three bugs it had separately priced at $4,500 https://rootnotes.in/article/ahsaycbs-the-first-patch-did-not-fix-it-and-the-vendor-said-so Root Notes en 2026-10-15T08:40:41.415Z The first patch did not fix it, the vendor said so, and the working one was behind a partner portal https://rootnotes.in/article/cisco-secure-email-gateway-cve-2026-76519-an-attachment-writes-the-file Root Notes en 2026-10-15T08:40:26.563Z The thing that scans attachments for malware is exploited by an attachment, and it runs as root https://rootnotes.in/article/pan-os-cve-2026-0322-exploited-root-on-the-management-interface Root Notes en 2026-10-15T08:40:06.275Z Palo Alto is patching a second exploited flaw this month, and this one runs as root on the management interface https://rootnotes.in/article/marklogic-31-flaws-and-a-patch-that-removes-access-on-purpose Root Notes en 2026-10-14T12:20:54.459Z Thirty-one flaws, and the patch takes away access people are using today https://rootnotes.in/article/p7-darksword-the-exploit-chain-leaked-and-now-it-arrives-in-an-advert Root Notes en 2026-10-14T12:20:46.168Z The exploit chain was disclosed, the source leaked, and now it arrives in an advert https://rootnotes.in/article/slugfest-npm-trusted-publishing-checked-the-name-not-the-id Root Notes en 2026-10-14T12:20:37.628Z npm checked the repository's name, and a name is something somebody else can claim