400+ AUR Packages Compromised with Infostealer and Rootkit

Last Updated: 2026-06-12T19:14:16Z (UTC) What’s Happening It appears a new AUR package maintainer impersonating a trusted maintainer adopted and infected 408+ packages. The compromise was reported and other AUR maintainers have been working to remove the infected packages. As of 2026-06-12T17:30:00Z (UTC), the AUR maintainers believe they have removed all malicious commits. They have also decided to implement some controls and limitations on functionality, including adopting packages. The...

discourse.ifin.network

Microsoft's open source tools were hacked to steal passwords of AI developers

Microsoft shut down dozens of GitHub code repositories for Azure and AI coding tools after a reported hack.

techcrunch.com

New Fragnesia Linux flaw lets attackers gain root privileges

Linux distros are rolling out patches for a new high-severity kernel privilege escalation vulnerability (known as Fragnasia and tracked as CVE-2026-46300) that allows attackers to run malicious code as root.

www.bleepingcomputer.com

YellowKey: доступ до даних, зашифрованих Windows BitLocker, можна легко отримати завдяки флешці з файлами

mezha.ua

Postmortem: TanStack npm supply-chain compromise

On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.

tanstack.com

Copy Fail — 732 Bytes to Root

CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.

copy.fail

The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables

An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.

www.trendmicro.com