Fake Arch Linux packages push malware with root privileges
Teaser from the source
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on privileges
Other advisories
- Not ratedosv:CVE-2026-97380MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
- Not ratedosv:CLEANSTART-2026-BQ90426pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation
- Not ratedosv:CVE-2026-71490OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
- CriticalCVE-2026-101306FreeBSD Project FreeBSD OS: Improper Check for Dropped Privileges
- HighCVE-2026-101305FreeBSD Project FreeBSD OS: Improper Check for Dropped Privileges
- CriticalCVE-2026-101306FreeBSD Project FreeBSD OS: Improper Check for Dropped Privileges
- HighCVE-2026-101305FreeBSD Project FreeBSD OS: Improper Check for Dropped Privileges
- HighCVE-2026-101304FreeBSD Project FreeBSD OS: Improper Check for Dropped Privileges
Other news entries
- Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fixNewsCSO Online
- Cisco Warns of Exploited Secure Email Gateway VulnerabilityNewsSecurityWeek
- Cisco patches new Secure Email Gateway zero-day exploited in attacksNewsBleepingComputer
- Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPNNewsSecurityWeek
- Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin ControlNewsThe Hacker News
- Cisco warns of critical flaws allowing Nexus switch takeoverNewsBleepingComputer
- SonicWall and Splunk Patch Critical VulnerabilitiesNewsSecurityWeek
- NCSC-2026-0406 [1.00] [M/H] Kwetsbaarheden verholpen in Cisco NX-OS SoftwareNewsNCSC-NL
ID