Borja López Soilán

Computer geek and OSS lover

[Florian Roth ⚡️ @cyb3rops]

People using Arch Linux should probably pay attention to this

More than 1,500 AUR packages were reportedly modified in a supply-chain compromise

The malicious changes are said to have included:
- credential theft
- SSH key collection
- browser data theft
- persistence via systemd services

This did not affect Arch Linux itself or the official repositories, but users who installed or updated affected AUR packages should review the details and check their systems

https://t.co/h5so9XUnlL

[The Lunduke Journal @LundukeJournal]

The AUR (Arch Linux User Repository) is continuing to be flooded with malicious code.

As of this writing, the Arch team has found at least 1,579 malicious packages (roughly 1.4% of all packages within the AUR), with more packages being updated with malicious code this morning.

This includes several popular utilities and libraries, including: gtkimageview, gdl, libgdata, and python-future.

A partial list of impacted packages can be found here:
https://t.co/LmHBksv8UC

[Tech with Mak @techNmak]

A dev got so frustrated watching his AI agent write 500 lines for a 5-line problem that he built a fix.

He called it Ponytail. Named after the guy every team has - long ponytail, oval glasses, been there longer than the version control. You show him fifty lines; he looks at them, says nothing, and replaces them with one.

Now your agent does the same. Before writing anything, it looks for a reason not to.

80-94% less code. 47-77% cheaper. 3-6x faster.

The best code is the code you never wrote.

GitHub Repo: https://t.co/WnFp9YNY53

[International Cyber Digest @IntCyberDigest]

‼️ UPDATE: It just doesn't stop: Almost 900 Arch Linux packages infected now.

https://t.co/xpRTsucoxA

[yousukezan @yousukezan]

HTTP/2を利用する主要Webサーバーに、わずかな通信で数十GBのメモリを消費させる新たなDoS攻撃「HTTP/2 Bomb」が公開された。PoCコードも既に公開されており、ApacheやEnvoyなどでは1台のクライアントからサーバー全体を停止状態へ追い込める可能性がある。

この攻撃は、HTTP/2のヘッダー圧縮機構であるHPACKとSlowloris型攻撃を組み合わせたものだ。通常の圧縮爆弾とは異なり、大量データを送るのではなく、極めて小さなヘッダーからサーバー側で大量のメモリ確保を発生させる。さらにゼロバイトのフロー制御ウィンドウを悪用し、確保したメモリを長時間解放させない。

研究者によると、Apache httpdやEnvoyでは単一の攻撃クライアントが約20秒で32GBのメモリを消費させることが可能という。サーバーはクラッシュせずスワップ状態へ陥るため、正規ユーザーのアクセスが極端に遅くなる。

影響は広範囲に及び、nginxは既に対策を実装済みで、ApacheもCVE-2026-49975として修正を公開した。一方でMicrosoft IISやEnvoy、Cloudflare Pingoraなどは記事時点で修正が提供されていないとされる。

対策として研究者は、可能であればHTTP/1.1への切り替えやヘッダー数の制限、コンテナ単位でのメモリ制限設定を推奨している。
https://t.co/FB6DxWNsWt

[It's FOSS @Itsfoss]

The company that once called Linux a "cancer" is now the one shipping its core tools to Windows users.

Microsoft just shipped GNU coreutils for Windows.

ls. grep. cat. cp. find. The same commands that have powered Unix and Linux systems for over 50 years are now available natively on Windows, maintained by Microsoft itself.

For context: GNU coreutils are the foundational utilities that every Linux and macOS system relies on for basic file operations, text processing, and shell scripting. They are the bedrock of Unix computing. Tens of millions of scripts, pipelines, and workflows run on them every day.

And now Microsoft is shipping and maintaining a build of them for Windows.

This is not WSL. You do not need a Linux subsystem running in the background. These tools run natively on Windows, with the exact same flags and behavior as on Linux. Your existing scripts just work.

Microsoft's goal: make moving between Linux, macOS, WSL, containers, and Windows completely frictionless. Write a script once. Run it anywhere.

The package bundles uutils/coreutils (a modern Rust rewrite of GNU coreutils), findutils, and grep into a single multi-call binary. Every command supports standard flags. Same commands, same pipelines, no translation needed.

The project is still in preview. But the direction is unmistakable.

[Raphaël Valyi @rvalyi]

According to the #Odoo Ministry of Information, the biggest Odoo event of the moment apparently doesn't exist. Maybe because it's about actual open source. Who knows.

Meanwhile, #OCADays is happening in Santander, Spain 🇪🇸 with contributors from across the ecosystem.

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

npm user?
➡️ One small change to stay safe, FREE

Add these aliases
➡️ pkg installs forbid using known malware

I run this:
- locally, to stay safe
- in my CI to detect compromised transitive dependencies early for my lib consumers

[abhisek @abh1sek]

Looks like a massive GitHub Actions exploitation campaign going on. Example commit:

https://t.co/4yD1WGi69r

https://t.co/goJsDeJEPw

Automated mass commits. We are investigating this.

cc: @github @GitHubSecurity

[SafeDep @safedepio]

🚨 The "𝙼𝚎𝚐𝚊𝚕𝚘𝚍𝚘𝚗" Campaign is live...

𝟻,𝟽𝟷𝟾 malicious commits to 𝟻,𝟻𝟼𝟷 GitHub repositories in a six-hour window.

Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected 𝙶𝚒𝚝𝙷𝚞𝚋 𝙰𝚌𝚝𝚒𝚘𝚗𝚜 workflows containing 𝚋𝚊𝚜𝚎𝟼𝟺-𝚎𝚗𝚌𝚘𝚍𝚎𝚍 bash payloads that exfiltrate:

- CI secrets,
- cloud credentials
- SSH keys
- OIDC tokens
- source code secrets

Check your repo / Technical details: https://t.co/tua3jYU1wa

[Marcos Besteiro 👧🏻👶🏻 @MarcosBL]

Every. Single. New. Google. Product.

[Daily CyberSecurity @the_yellow_fall]

GitHub confirms a perimeter breach by TeamPCP. An administrative VS Code extension supply-chain worm exfiltrated 3,800 proprietary core source repositories

#GitHubBreach #TeamPCP #SupplyChainAttack #VSCode #CopilotLeak #DevSecOps #Infosec #CredentialTheft
https://t.co/qt2pajMdfu

[Cisco | CryptoAlert @CiscoCANFT]

Update: el ataque TanStack / Mini Shai-Hulud se extiende y podría ser el más grave del año

El total de versiones maliciosas supera las 400 entre npm y PyPI. La lista sigue creciendo porque es un worm que usa los tokens robados para publicar más exploits automáticamente

El worm Mini Shai-Hulud (TeamPCP) se convirtió en una campaña masiva y "auto-propagable"

- Más de 200 paquetes infectados: Hay reportes de 169 paquetes npm con 373 versiones maliciosas confirmadas

-Propagación del worm a 200+ paquetes adicionales(incluyendo OpenSearch, Mistral AI en npm + PyPI, Guardrails AI, etc.)

- Se “regó” a otras herramientas y editores: El payload ya no solo se ejecuta en `npm install`. Se propaga y persiste escribiéndose en:
- `.claude/settings.json` y `.claude/router_runtime.js` (Claude Code)
- `.vscode/tasks.json` y `.vscode/setup.mjs` (VS Code)

Cada vez que abres el editor o usas Claude Code, el malware se vuelve a ejecutar solo

npm uninstall no sirve de nada: la infección sobrevive en tu entorno de desarrollo

Si tocaste cualquier tanstack/*, uipath, mistralai o paquetes de la lista en las últimas 48 horas: asume que tu máquina y tu CI están quemados. Rota TODO YA (tokens, keys, credenciales), audita .claude y .vscode manualmente, revisa commits nuevos, limpia todo desde cero y trata tu entorno como comprometido

El ecosistema de dependencias ya no es riesgoso… es campo minado en llamas. Confiar en “npm install” o “pip install” en 2026 es suicida

[Socket @SocketSecurity]

Update: Socket has found 121 more compromised npm package artifacts across 84 package names, including 64 UiPath artifacts.

Combined w/ TanStack, the current known total is 205 affected npm package artifacts across enterprise automation, AI/MCP, auth, workflow, and dev tooling.

[Jaime Gómez-Obregón @JaimeObregon]

Un desarrollador danés, flipando con Autofirma, deja un educado comentario en el repositorio de desarrollo.

Es imposible explicarlo mejor:

«En el sector privado, lanzar software en este estado supondría un fracaso comercial inmediato. El hecho de que esta aplicación sea obligatoria para los ciudadanos españoles no exime al equipo de desarrollo de cumplir con los estándares modernos de seguridad y distribución. Exige estándares más altos, no más bajos».

¡Necesitamos más software de código abierto en la Administración pública!

[Borja López Soilán @NeoPolus]

@Akashi203 Some words have little meaning ("the", "a") but are really frequent, and easy to predict (at least in some languages) ie if you hear "please push..." your mind expects "the" or "a" as the next word. Speculative decoding proves that taking shortcuts is feasible for most words.

[impulsive @weezerOSINT]

Windows defender has been compromised.
right now there is a public unpatched exploit that gives any app on your windows PC full system admin access. no password. no popup. nothing

your antivirus doesnt stop it. your antivirus IS the exploit. windows defender is the attack vector

ransomware gangs can use this to encrypt your entire machine and steal every saved password, browser session, and discord token you have. fully patched windows 11. real time protection on

thread

[Kruptos @KuptoKosmos]

🇪🇺 L’app European Age Verification est vendue comme open source, privacy-by-design et ultra-respectueuse de la vie privée...

⚠️ Pourtant, sa doc officielle donne le mode d’emploi exact pour que quelqu’un (police, services de renseignement, cabinet du Premier ministre…) puisse se placer au milieu des échanges de l’app et lire ou modifier les données en toute discrétion !!

🚨 La backdoor MITM est intégrée au cœur technique de tout le projet EUDI Wallet / European Digital Identity

Dites non à la surveillance de masse abusive et protégez le futur de vos enfants contre ces gens 🤥

👁️ #AgeVerification #Backdoor

[Paul Moore - Security Consultant  @Paul_Reviews]

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

[zeb @zebassembly]

The situation in Spain where LaLiga can force ISPs to ban any IP range they want without a court order is ridiculous and so aggressively anti-internet that it's causing real harm to Spain's citizens.

Docker is one thing, but the other comments in this HN post are way worse (anti-theft alarms, apps for helping people suffering from dementia). It's horrible that clouds that serve multiple sites from the same IPs are being strong-armed into either taking down anything LaLiga wants without a court order or suffering mass ip blocks.