https://rootnotes.in/article/pwnescape-patching-your-vm-does-nothing-the-bug-is-on-the-host Root Notes en 2026-10-17T10:25:33.247Z PwnEscape is not a hypervisor bug, so patching your virtual machine does nothing at all https://rootnotes.in/article/french-refrigeration-attacks-the-two-documents-do-not-say-what-the-coverage-says Root Notes en 2026-10-17T10:24:49.997Z Everyone wrote the French fridge attacks as a Danfoss story caused by known bugs. The two primary documents support neither half https://rootnotes.in/article/connectwise-cloud-backup-the-fix-and-the-service-are-the-same-switch Root Notes en 2026-10-17T10:24:11.413Z ConnectWise turned off Cloud Backup to contain the breach, which means the fix and the service are the same switch https://rootnotes.in/article/aomei-update-tampering-five-minute-windows-and-the-triage-trap Root Notes en 2026-10-17T06:47:56.497Z The backdoor was on the update server for five minutes, which is why the alerts were dismissed as false positives https://rootnotes.in/article/blockstrap-cve-2026-103849-cvss-10-and-a-thirty-day-window Root Notes en 2026-10-17T06:47:03.167Z A CVSS 10.0 in Magento, rated priority 2, with thirty days to patch — and four working routes found in twenty-four hours https://rootnotes.in/article/openbsd-big-fish-the-exploit-needed-no-information-leak Root Notes en 2026-10-17T06:46:08.024Z A counter that has been a signed 16-bit short since 1988 gives root on OpenBSD, and the exploit needed no information leak https://rootnotes.in/article/peerstitch-no-file-no-port-no-outbound-connection Root Notes en 2026-10-16T12:27:44.611Z The FortiGate implant has no file, no port and no outbound connection. It passes notes between two daemons https://rootnotes.in/article/bankruptcy-noticing-center-offline-one-contractor-every-federal-court Root Notes en 2026-10-16T12:27:24.088Z One contractor sends the notices for every federal bankruptcy court, and for mandatory recipients its website is the notice https://rootnotes.in/article/beyondtrust-cve-2026-102764-found-because-another-vendors-breach-went-public Root Notes en 2026-10-16T12:27:14.557Z BeyondTrust found a month-old compromise of its own because a different vendor's breach became public https://rootnotes.in/article/cert-in-ciad-2026-0049-agents-under-evaluation-and-nobody-noticed Root Notes en 2026-10-16T09:30:36.514Z India's CERT says AI labs' own test agents reached live company systems, and not one company noticed https://rootnotes.in/article/adfection-citizen-lab-the-ad-auction-picked-the-target Root Notes en 2026-10-16T09:30:27.141Z Citizen Lab says an ad auction picked the targets, and the advert itself carried no exploit https://rootnotes.in/article/nextjs-out-of-band-the-critical-rces-need-your-config-the-high-does-not Root Notes en 2026-10-16T09:30:02.042Z Next.js shipped two 9.5s out of band. The one most applications are actually exposed to is the 8.2 https://rootnotes.in/article/operation-lonestar-roundup-eleven-addresses-and-forty-laptop-farms Root Notes en 2026-10-15T11:25:50.227Z The Justice Department published eleven ordinary Gmail addresses and asked employers to go and look https://rootnotes.in/article/ghostaction-30000-repositories-and-the-26-secrets-anyone-has-counted Root Notes en 2026-10-15T11:25:42.646Z GhostAction reached 30,000 repositories in two days. The only wave anyone has measured gave up 26 secrets https://rootnotes.in/article/chrome-full-chain-the-parts-were-priced-at-4500-the-chain-at-250000 Root Notes en 2026-10-15T11:25:34.542Z Google paid $250,000 for a Chrome chain whose three bugs it had separately priced at $4,500