[ebpf-rootkit]

June 18, 2026

• Atomic Arch — attackers hijacked 1,500+ orphaned Arch Linux AUR packages, lacing PKGBUILD install hooks to deploy a Rust infostealer and an eBPF rootkit; Arch suspended new AUR registrations. Nextron published YARA for the malicious PKGBUILD/.install/ALPM hooks (SecurityWeek, Nextron). · Supply Chain

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel