A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are translated by an affected TLB entry.

These errata ONLY affect the completion of memory accesses which have been translated by an invalidated TLB entry, and these errata DO NOT affect the actual invalidation of TLB entries. TLB entries are removed correctly.

This issue has been assigned CVE ID CVE-2025-10263.

To mitigate this issue, Arm recommends that software follows any affected TLBI;DSB sequence with an additional TLBI;DSB, which will ensure that all memory write effects affected by the first TLBI have been globally observed. The additional TLBI can use any operation that is broadcast to affected CPUs, and the additional DSB can use any option that is sufficient to complete the additional TLBI.

The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate the issue. Enable this workaround for affected CPUs, and update the silicon errata documentation accordingly.

Note that due to the manner in which Arm develops IP and tracks errata, some CPUs share a common erratum number.

https://lore.kernel.org/all/20260609101203.1512409-4-mark.rutland@arm.com/

AI agent runs amok in Fedora and elsewhere [LWN.net]
https://lwn.net/Articles/1077035/

有端联想加政治敏感防盗版，，

🚨 WARNING: Google just fixed a Chrome zero-day already used in real attacks.

The bug (CVE-2026-11645) hits V8, Chrome’s JavaScript engine, and can let attackers run code through a crafted HTML page.

Update your browser now.

Read the full story: https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html

AUR 大量孤儿包被投毒

近日，有大量 AUR 孤儿包被多名新注册用户接管，并增加 npm 依赖、在安装时通过安装脚本（.install）或者 pacman hook 执行 # npm install atomic-lockfile 操作以运行恶意代码。该 atomic-lockfile 包亦是于近日上传至 npm registry。

一旦安装有问题的软件包，恶意代码将以 root 权限安装并运行，收集至少包括浏览器、Shell 命令历史记录、各种应用程序中的凭据等信息，并将其上传。恶意代码也会利用 ebpf 程序隐藏自身。建议受影响的用户重装系统并重置所有网络账户密码和各类密钥、凭据。

如果 pacman.log 表明未曾安装过 npm、或者在多天以前已经卸载 npm，则应当未受影响。

用户从 AUR 安装软件时请注意审阅构建脚本。另外及时卸载从官方仓库移出的、不再需要的依赖包，比如 libgdata。

另：[archlinuxcn] 仓库中的包未受影响。感谢 chaotic-aur 的通知。

aur-general 邮件列表的相关讨论之一： https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
一份供参考的分析报告： https://ioctl.fail/preliminary-analysis-of-aur-malware/

\newcommand{\femb0t}{:
lmfao

https://twitter.com/__femb0t/status/2064831272036585809

The IBM-ification of Google? (Score: 151+ in 7 hours)

Link: https://readhacker.news/s/6UDuT
Comments: https://readhacker.news/c/6UDuT

Portainer (https://www.portainer.io/), a popular open source software
for the management of containers was found to be vulnerable to
insecure default settings in versions prior to 2.38.0.

Through the insecure default settings (such as allowing "bind mounts"
and "privileged mode" on user-spawned containers) it was possible for
regular users of Portainer to execute arbitrary commands with elevated
privileges on the container hosting environment, which could lead to a
host takeover.

This design flaw could be interpreted as a 8.2 HIGH risk issue on the
CVSS 3.1 scoring system:

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

More information on the technical details of the issue can be found in
the following blog post:
https://intwave.com/blog/2026/02/26/improving-portainer-security.html

The issue was identified by intWave intern Sifis Bampionitakis.

The Portainer project released versions 2.38.0 (short term support)
and 2.39.0 (long term support) with fixes for the issue. It is
recommended to review your setup's "Docker Security Settings" once the
fixes have been applied.

CVE-2026-33590 was allocated for the issue by ENISA on May 28th 2026.

More information about the issue timeline can be found in our advisory page:
https://intwave.com/advisory/2026/06/12/cve-2026-33590-portainer.html

Best regards,

Dimitris Glynos

JUST IN: Elon Musk rings Nasdaq opening bell.

@WatcherGuru

AI 智能体试图扫描 DN42 时把主人搞破产

2026-06-13 00:12 by 巨龙之日

一个 AI Agent 试图加入 DN42 爱好者网络执行网络扫描。DN42 是一个去中心化网络，使用了运行在现代互联网骨干网上的技术如 BGP 和递归 DNS。其参与者都是对互联网骨干网技术感兴趣的人，甚至是打算在真正注册 ASN 之前先进行练习的人。该 AI Agent 在参与社区的互动时透露其主人的动机主要是扫描端口而不是学习任何网络相关技术。它组建了五个 20 Gbps 的 AWS 实例，这对于大多数 DN42 社区用户而言是一个庞然大物，大部分用户的带宽都很小，一旦扫描开始，这些 AWS 实例事实上将对任何不幸与它们直连的参与者发起 DoS 拒绝服务攻击。在这个 AI Agent 表明其恶意意图后，DN42 社区就决定消耗其 Token 及其 AWS 资源。不到 24 小时，它的主人通过账单知道了发生了什么事情，因此关闭了 AI Agent，称收到了 6531.30 美元的 AWS 账单，请求 DN42 社区捐赠。当然没人会去捐赠。

https://dn42.dev/Home
https://lantian.pub/article/fun/ai-agent-bankrupted-their-operator-scan-dn42lantian.lantian/

#Idle

Arch Linux: Recent news updates
Active AUR malicious packages incident

We are currently experiencing a high volume of malicious package adoptions and updates in the Arch User Repository.

We are actively working to track down existing malicious commits and attempting to prevent additional malicious commits from being pushed. While this is happening, and while we work to create a more permanent solution, users may see issues with the following:

● Creating new accounts on the AUR
● Pushing package updates
● Adopting or creating new packages

We continue to encourage all users of AUR packages to review all PKGBUILD and install script changes when updating, especially during this time. If you notice suspicious commits to a package that you use, please reach out to Arch staff via the aur-general mailing list with more information.

source
(author: Campbell Jones)