Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

A supply chain attack targeted the Arch User Repository (AUR) by publishing over 1,500 malicious packages. Attackers modified abandoned packages to execute malicious code during installation, leveraging eBPF for persistence and hiding. The malware is capable of credential and secret harvesting, including SSH keys and tokens, and can evade detection by hiding processes and files. Arch Linux responded by suspending new AUR account registrations to contain the attack and is actively removing malicious commits.

• securityweek.com/atomic-arch-supply-chain-attack-hits-1500-aur-packages/ (opens in a new tab)

• Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxExploitedVulnerability2026-10-30
• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• ZDI-26-834: Linux Kernel IPv6 AH Routing Header Integer Underflow Local Privilege Escalation VulnerabilityHighVulnerability2026-10-29
• ZDI-26-835: Linux Kernel Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation VulnerabilityHighVulnerability2026-10-29