Linux 7.1 ships while 7.2 is already bumping compiler minimums, the AUR got hit twice in a day with the second wave obfuscated well enough to slip past the initial response, and a DNS caching quirk means dead domains can still look alive in your monitoring.
// SECURITY FOCUS
AUR hit by second, more sophisticated malware wave — 1,500+ packages affected
The first wave injected a malicious npm package (`atomic-lockfile`) into orphaned AUR packages to exfiltrate credentials; Arch devs thought they had it contained, then a second wave appeared within 24 hours using code obfuscation to hide intent. If any of your team runs Arch and pulled AUR packages in the last week, assume credential compromise — the exfil target is ‘sensitive data’, which in dev contexts typically means SSH keys, cloud tokens, and shell history.
What to do: Cross-reference your installed AUR packages against the affected list at https://gr.ht/aur_pkg_list.txt, rotate any secrets on machines where matches exist, and treat orphaned AUR packages as untrusted until Arch confirms the cleanup is complete.
- Linux 7.1 released: new clone() flags, BPF for io_uring, NTFS driver, 486 support removed — LWN.net · Jun 14
Linux 7.1 is out, dropping support for 486-based architectures and shipping a completely rewritten NTFS driver. New clone() flags simplify process management, BPF gets io_uring support, and the ublk user-space block driver gains zero-copy I/O. Sched_ext picks up initial sub-scheduler support – described as incomplete – alongside more swapping improvements. The article is thin on detail, pointing to LWN’s two merge-window summaries for the full picture. - OpenTelemetry vs. Prometheus: Key Differences & Use Cases — groundcover · Jun 13
OpenTelemetry and Prometheus solve different problems: OpenTelemetry is a vendor-neutral instrumentation framework that collects metrics, logs, and traces across whatever backend you choose, while Prometheus is a metrics-only monitoring tool with built-in alerting. The practical distinction that matters most is data scope – if you need traces or logs alongside metrics, Prometheus alone won’t get you there, and you’d need to bolt on Jaeger, Logstash, or similar. Prometheus also has real scaling constraints since it’s designed around a single server without native multi-tenancy, whereas OpenTelemetry collectors scale horizontally. The two aren’t mutually exclusive: a common pattern is using OpenTelemetry for instrumentation and data collection while Prometheus handles metrics alerting, with Grafana sitting in front of both for visualization. The article’s main practical advice is to avoid redundant ingestion – don’t pull metrics through both an OTel Prometheus receiver and direct Prometheus scraping at the same time. - Linux 7.2 raising minimum LLVM/Clang requirement, adding distributed ThinLTO support — Phoronix · Jun 15
Linux 7.2 raises the minimum Clang requirement from 15 to 17 for kernel builds, a one-year bump in LLVM release cycles that drops workarounds for Clang’s old scope checker and a GCC 8.1+ incompatibility with const variables in _static_assert macros. The other headline Kbuild change is first-class support for LLVM’s Distributed ThinLTO (DTLTO) mode, which offloads ThinLTO work across machines and should cut build times compared to in-process ThinLTO – useful if you’re running large kernel CI pipelines. If you’re building kernels with Clang 15 or 16, plan an upgrade before 7.2 lands. The release also adds a kconfig-sym-check target for catching dangling Kconfig symbol references and hardens Kconfig against null pointer dereferences. - Spotlight on SIG Storage — Kubernetes Blog · Jun 15
Xing Yang, co-chair of SIG Storage, walks through the group’s current priorities and recent milestones in this Q&A-style spotlight. Two features just shipped in Kubernetes v1.36: VolumeGroupSnapshot hit GA, enabling atomic crash-consistent snapshots across multiple PersistentVolumes simultaneously, and CSI Changed Block Tracking moved to Beta, letting storage systems report only modified blocks to cut incremental backup transfer costs. VolumeAttributesClass graduated to GA in v1.34, allowing users to adjust IOPS and throughput on live volumes via the Kubernetes API without downtime or recreation. On the near-term roadmap: Volume Health is moving toward automated remediation support, Mutable PV Affinity (alpha in v1.35) enables zonal-to-regional or disk-type migrations, and the Container Object Storage Interface (COSI) is transitioning to v1alpha2 ahead of a planned Beta. The SIG is also fielding early discussions around volume replication, raised at KubeCon Atlanta, and is actively looking for community help on tests, bug fixes, and feedback on the alpha features. - The ghost domain problem in DNS: removed domains can still appear healthy to uptime checkers — Freek Van der Herten · Jun 14
DNS recursive resolvers can keep stale delegations cached long after a domain is removed from its registry, making a dead domain appear healthy to uptime checkers that rely on those resolvers. The Oh Dear team ran into this edge case and explains how they’re tightening their resolver setup to reduce the blind spot. If you run an uptime monitoring service – or depend on one – it’s worth understanding that a “healthy” check doesn’t necessarily mean the domain is still live and properly delegated.
// In other news
ai
- Statement on the US government directive to suspend access to Fable 5 and Mythos 5 (Simon Willison) · Jun 13 — US government directed Anthropic to suspend access to Fable 5 and Mythos 5 – Anthropic’s statement confirms the order is real and currently in effect, with no explanation of the legal basis.
- Why AI hasn’t replaced software engineers, and won’t (Simon Willison) · Jun 14 — Arvind Narayanan and Sayash Kapoor argue AI coding tools shift which skills matter rather than eliminating the role – worth reading for the specific claims about task decomposition and verification costs.
- Publishing WASM wheels to PyPI for use with Pyodide (Simon Willison) · Jun 13 — Pyodide 0.314.0 now lets you publish standard WASM wheels to PyPI, meaning pure-Python packages can target browser/WASM runtimes via the normal pip ecosystem without a separate distribution channel.
- olmo-eval: An evaluation workbench for the model development loop (Hugging Face Blog) · Jun 12 — AllenAI’s olmo-eval is an open evaluation workbench built for the model development loop, targeting researchers who need reproducible evals across OLMo checkpoints rather than one-shot leaderboard runs.
cloud
- Scaling Security Insights: how we achieved a 10x increase in global scanning capacity (Cloudflare Blog) · Jun 12 — Cloudflare’s Security Insights scanner now handles 120+ scans/second globally after Kafka consumer, Postgres query, and API optimizations – postmortem-style breakdown of where the bottlenecks actually were.
- More Tailscale tricks for your jailbroken Kindle (Tailscale) · Jun 12 — Tailscale on jailbroken Kindles now supports proxy and TUN modes, and a community plugin extends the same to Kobo and Pocket readers – niche but a solid demonstration of Tailscale’s userspace networking portability.
k8s
- Securing CI/CD for an open source project: Locking down dependencies (CNCF Blog) · Jun 12 — Part 2 of Cilium’s CI/CD hardening series covers dependency pinning – specific techniques for locking third-party actions and packages so a compromised upstream can’t inject code into your pipeline.
linux
- Hundreds of AUR packages compromised (LWN.net) · Jun 12 — Hundreds of orphaned AUR packages were backdoored via a malicious npm package injected by an attacker who adopted abandoned packages – Arch users should audit any AUR packages installed in the last week.
- Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages (Phoronix) · Jun 13 — The AUR malware incident grew from 400 to over 1,500 compromised packages before Arch maintainers declared it under control; full package list was published so you can check your install history.
- Linux 7.1 Released: New NTFS Driver, Intel FRED For Panther Lake, Faster Arc Graphics (Phoronix) · Jun 14 — Linux 7.1 is out with a new NTFS driver, Intel FRED support for Panther Lake, and Arc graphics improvements – distros on a rolling release cycle should start seeing it in the next few days.
- AVX-512 Optimization For Linux RAID Showing Up To 41% Improvement On AMD Ryzen 9 9950X (Phoronix) · Jun 12 — Google’s Eric Biggers landed AVX-512 xor_gen() optimizations for Linux RAID that show up to 41% throughput improvement on AMD Ryzen 9 9950X – relevant if you’re running RAID5/6 on modern x86_64 hardware.
- Open-Source Success Achieved For Greater Transparency & Security: Running AMD openSIL + Coreboot On EPYC (Phoronix) · Jun 12 — AMD’s openSIL + Coreboot now boots on EPYC, replacing closed AGESA for CPU silicon initialization – first hands-on review confirms it works, with notes on what’s still missing for production use.
sec
- June 2026 Patch Tuesday: Microsoft Patches 206 Vulnerabilities Including Three Publicly Disclosed Zero-Days (CrowdStrike) — June 2026 Patch Tuesday covers 206 CVEs including three publicly disclosed zero-days – a high patch volume month; prioritize the zero-days before the usual 30-day window if you’re on default patching cadence.
sre
- More Fake Mastodon Signups (Aphyr) · Jun 12 — Aphyr’s Mastodon instance was hit by a bot signup flood starting 2026-05-30 and documents the filtering and rate-limiting measures applied – practical reference for anyone running a small federated server under similar pressure.
web
- #[RouteParameter] Does Not Bind Your Model (Freek Van der Herten) · Jun 12 — Laravel’s #[RouteParameter] attribute only reads the raw route value – it does not trigger implicit model binding, so your controller won’t get a hydrated Eloquent model unless you add the binding explicitly.
- Multi-Agent Orchestration in Laravel: When You Actually Need It (Freek Van der Herten) · Jun 13 — Freek’s take on Laravel multi-agent setups: a second agent only makes sense when it genuinely needs its own model, toolset, or instruction context – otherwise you’re adding handoff overhead for nothing.
- One core, many clients: the new Flare JavaScript client architecture (Spatie) · Jun 12 — Flare’s JS client was refactored from one browser-only bundle into a platform-agnostic core with thin framework adapters – useful reference architecture if you’re building a multi-runtime JS SDK.
486 is gone, the AUR is still cleaning up — check your uptime checker while you’re at it.
Linkzine 
Leave a comment