https://rootnotes.in/article/comparitech-q3-2026-the-record-is-2627-claimed-and-247-confirmed Root Notes en 2026-10-10T07:21:20.079Z The record quarter counts 2,627 attacks, and the victims confirmed 247 of them https://rootnotes.in/article/flax-typhoon-seizures-and-the-five-kev-additions-from-2015-and-2016 Root Notes en 2026-10-10T07:18:16.807Z Three of the five vulnerabilities added to the exploited catalog this week were disclosed in 2015 and 2016 https://rootnotes.in/article/monstercloud-indictment-prosecutors-say-the-decryption-was-a-ransom-payment Root Notes en 2026-10-10T07:17:45.546Z Prosecutors say the proprietary decryption technology was a payment to the people holding the keys https://rootnotes.in/article/lmcache-cve-2026-105192-unpickled-before-the-type-check Root Notes en 2026-10-10T06:35:49.918Z The cache unpickles the message before it checks what kind of message it is https://rootnotes.in/article/artex-south-korean-finance-the-open-directory-held-the-operators-own-cv Root Notes en 2026-10-10T06:21:15.484Z The server running the intrusions had a browsable folder, and what was in it looked like the operator's CV https://rootnotes.in/article/cctld-registry-hijacks-the-certificates-were-issued-correctly Root Notes en 2026-10-10T06:21:02.168Z The certificates were issued correctly — the attackers controlled the DNS, which is all the check asks for https://rootnotes.in/article/matchboil-uac-0099-in-development-a-year-before-anyone-documented-it Root Notes en 2026-10-09T12:58:00.900Z The downloader's compile dates run a year earlier than the first public report of it https://rootnotes.in/article/fakegit-17610-repositories-and-almost-none-of-them-new Root Notes en 2026-10-09T12:57:50.121Z Nobody had to create a single new repository — the operator edited the README on the ones that already existed https://rootnotes.in/article/midnight-mimosa-the-malware-is-in-the-system-partition-before-the-first-boot Root Notes en 2026-10-09T12:34:35.442Z The malware sits in the system partition, which means the first owner was infected before the first boot https://rootnotes.in/article/double-counter-discord-bot-breach-the-server-they-had-already-moved-off Root Notes en 2026-10-09T05:51:25.935Z The breach came through a server the company had already migrated away from, still running an analytics tool https://rootnotes.in/article/firefox-wallet-extensions-the-real-wallet-code-with-one-function-hooked Root Notes en 2026-10-09T05:47:21.022Z Four of the fake wallets were the real wallet's code with the import function hooked https://rootnotes.in/article/sungrow-isolarcloud-cve-2026-107194-one-field-set-to-five-ignores-the-password Root Notes en 2026-10-09T05:41:32.549Z One field set to five logged the researcher in as anyone, and the account owner was never told https://rootnotes.in/article/azazel-gentlemen-mcp-as-a-command-channel-and-the-affiliate-who-kept-the-money Root Notes en 2026-10-08T12:01:52.358Z The ransomware affiliate ran his commands through an AI assistant's tool protocol, then scanned the internet for more of them https://rootnotes.in/article/denmark-cpr-register-8-8-million-looked-up-through-lawful-access Root Notes en 2026-10-08T11:59:31.911Z Nobody broke into Denmark's population register — a company allowed to search it looked up 8.8 million people