Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
5 / 11 results
highbug_reportVulnerabilityMalicious AUR packages impersonate yay and paru, execute malware as root
Arch Linux users who installed typosquatted packages from the Arch User Repository (AUR) between October 13-15, 2026. Specifically packages named "yyay" and similar variants impersonating the legitimate yay and paru AUR helper tools, uploaded by user…
highbug_reportVulnerabilityArch Linux disables AUR package adoption after malicious takeovers
Arch Linux Arch User Repository (AUR) - all community-maintained packages. Users who installed or updated AUR packages during the compromise window are potentially affected. Scope limited to AUR; official Arch repositories unaffected.
criticalbug_reportVulnerabilityArch User Repository supply chain attack: 400+ packages backdoored
Arch Linux users who installed or updated packages from the Arch User Repository (AUR) during the compromise window. Over 400 AUR packages contained malicious build scripts deploying a Rust-based infostealer.
criticalbug_reportVulnerability400+ Arch User Repository packages compromised with rootkit and infostealer
Arch Linux users who installed or updated packages from the Arch User Repository (AUR). Over 400 AUR packages confirmed compromised. Specific package names and versions not yet disclosed.
highbug_reportVulnerabilityPinTheft Linux privilege escalation PoC released for Arch Linux
Arch Linux systems. Specific affected package versions not disclosed; vulnerability has been patched in recent updates. Other Linux distributions may be affected depending on package configurations.