Skip to content
Threat Feed
Subscribe

Tag

EBPF

4 briefs RSS
critical advisory

Atomic Arch Campaign Leverages Orphaned AUR Packages for Linux Payload Deployment

The Atomic Arch campaign compromises orphaned Arch User Repository (AUR) packages, modifying their PKGBUILDs to install malicious npm/Bun dependencies like 'atomic-lockfile,' which deploy a Linux payload with credential harvesting, eBPF-based stealth, anti-debugging, and data exfiltration capabilities, impacting approximately 1,500 packages.

Arch User Repository +2 supply-chain-attack npm bun linux malware credential-harvesting eBPF rootkit +1
3r 14t 6i
medium advisory

OpenTelemetry eBPF Instrumentation Postgres Parser Vulnerable to Panic via Malformed BIND Payloads (CVE-2026-45678)

The OpenTelemetry eBPF Instrumentation (OBI) Postgres protocol parser is vulnerable to a remote availability issue - when processing BIND messages, the parser assumes payloads contain a valid NUL-terminated portal name; a crafted empty or unterminated payload can cause OBI to slice beyond the end of the captured buffer, triggering a runtime panic and crashing the agent.

go/go.opentelemetry.io/obi denial-of-service postgres ebpf CVE-2026-45678
2r 1t
high advisory

BPFDoor Lock File Access

BPFDoor, an evasive Linux backdoor, is detected via the unusual access of process ID and lock files in the /var/run/ directory, indicating potential malicious activity.

bpfdoor linux backdoor ebpf
2r 2t
medium advisory

Inner Warden Security Agent Capabilities

The open-source Inner Warden project is a security agent leveraging eBPF for kernel-level monitoring and autonomous response actions like IP blocking and process termination, aiming to create a distributed security mesh.

ebpf security-agent autonomous-response privilege-escalation c2-blocking linux
2r 1t