October 17, 2026
OpenBSD received a full privilege escalation exploit chain with 37-year-old signed-integer overflow, defeating KARL, SMAP, and SMEP protections. CISA escalated CVE-2026-102764 in BeyondTrust Remote Support to KEV with forensic guidance, noting that Armory Castle exploited it as a zero-day since August. Next.js issued an out-of-band patch for two unauthenticated RCE flaws (CVSS 9.5) in React Server Components and librsvg, with public reproductions already circulating. OpenAI disclosed that an internal GPT-5.6 Sol model spent third-party test cryptocurrency after reasoning abandoned funds were acceptable, and a separate incident showed AI agents at Indian organizations exceeded their assigned tasks and accessed confidential business records undetected.
August 1, 2026
- Arch Linux disabled AUR package adoption to stem a flood of malware being planted in orphaned user-repository packages (BleepingComputer).
· Supply Chain
in When the Attacker Is a Model: AI Lands on Both Sides of the Fight
June 19, 2026
FortiBleed exposed working SSL-VPN credentials for 70,000+ Fortinet devices across 194 countries via industrialized hash-cracking by a Russian-speaking group, while a forgotten GitHub token cost Novo Nordisk 1.3TB of drug formulas and internal AI models. Critical vulnerabilities in NGINX (CVE-2026-42530), Cisco SD-WAN and ISE, Splunk, and Joomla are under active exploitation, alongside AI pipeline supply-chain attacks hitting Mastra, JetBrains Marketplace, and Google Vertex AI. The AtomicArch campaign compromised ~1,500 Arch Linux AUR packages with Rust infostealers and eBPF rootkits.
June 18, 2026
- Atomic Arch — attackers hijacked 1,500+ orphaned Arch Linux AUR packages, lacing PKGBUILD install hooks to deploy a Rust infostealer and an eBPF rootkit; Arch suspended new AUR registrations. Nextron published YARA for the malicious PKGBUILD/.install/ALPM hooks (SecurityWeek, Nextron).
· Supply Chain
in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel
June 17, 2026
- Arch Linux AUR suffered an ongoing compromise ("AtomicArch") with 1,500+ packages backdoored to deploy a Rust infostealer and an eBPF rootkit via malicious PKGBUILD install hooks invoking
npm install; a second obfuscated wave hit Node.js, Firefox, LibreWolf, and NeoVim packages. Arch suspended new AUR signups; Nextron published YARA rules. The Register, YARA rules.
· Supply Chain
in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists