M

Max

@max

💬 XMPP: [email protected]

Приєднався квітень 2026

Пости

linux security
посилання

400+ AUR Packages Compromised with Infostealer and Rootkit

Last Updated: 2026-06-12T19:14:16Z (UTC) What’s Happening It appears a new AUR package maintainer impersonating a trusted maintainer adopted and infected 408+ packages. The compromise was reported and other AUR maintainers have been working to remove the infected packages. As of 2026-06-12T17:30:00Z (UTC), the AUR maintainers believe they have removed all malicious commits. They have also decided to implement some controls and limitations on functionality, including adopting packages. The...

discourse.ifin.network

M
@max · 13 червня 2026р. · 0
javascript security
посилання

Postmortem: TanStack npm supply-chain compromise

On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.

tanstack.com

M
@max · 12 травня 2026р. · 0
security
посилання

Copy Fail — 732 Bytes to Root

CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.

copy.fail

M
@max · 30 квітня 2026р. · 0
security
посилання

The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables

An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.

www.trendmicro.com

M
@max · 21 квітня 2026р. · 0
linux
посилання

State of Kdenlive - 2026

In 2025, the Kdenlive team continued grinding to push the project forward through steady development, collaboration, and community support. Over the past year we’ve found a nice balance between adding new features, bug fixing, polishing the user interface, and improving performance and workflow, with stability taking priority over feature creep.

kdenlive.org

M
@max · 19 квітня 2026р. · 0
vcs
посилання

GitHub Stacked PRs

Break large changes into small, reviewable, stacked pull requests with first-class GitHub support.

github.github.com

M
@max · 14 квітня 2026р. · 0
culture
посилання

EFF is Leaving X

After almost twenty years on the platform, EFF is logging off of X. This isn’t a decision we made lightly, but it might be overdue.

www.eff.org

M
@max · 09 квітня 2026р. · 0