CVE
CVE-2026-53264
CWE
CWE-362, CWE-416, CWE-494, CWE-506, CWE-522, CWE-829
Affected Surface
- Arch Linux developer and build hosts that updated AUR packages during the 29 July-2 August malware wave
- PyPI consumers and analysis systems that installed the likely malicious `anthropickit==999.9.9` package described after Anthropic's 30 July incident disclosure
- npm consumers that imported compromised Joyfill prereleases carrying the DEV#POPPER RAT chain
- Linux hosts on vulnerable `net/sched` kernel lines where local code execution can still be amplified into root via `CVE-2026-53264`
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research published from Thursday, 30 July through Sunday, 2 August 2026, excluding items already covered in the 28 July briefing.
Top Article
Arch AUR’s August malware wave: openconnect-sso and 89 named packages
This period’s most important new story is the Arch AUR malware wave, because it shows a package ecosystem suspending its own stewardship mechanics under live incident pressure. Arch deserves response credit for disabling package adoption and then all pushes while cleanup continued, while IFIN deserves early malware-analysis credit for tying the openconnect-sso payload back to Tor-backed tradecraft resembling the earlier June campaign. The story belongs beside Atomic Arch, Joyfill’s import-time DEV#POPPER RAT chain, and Anthropic’s likely anthropickit package: in every case, the trusted package path became the real malware runtime.
What matters most is that the current AUR wave was not just a typo or a fake package name. Public reporting shows trusted adopted packages gaining binaries such as validator inside the build path, with openconnect-sso reportedly executing the payload through sudo during packaging. That turns an AUR update into a host-compromise event on exactly the Linux workstations and build boxes AppSec teams use every day.
More news
anthropickit: likely PyPI package behind Anthropic’s one-hour credential theft incident
This remains one of the clearest package-registry stories of the week because Anthropic’s disclosure ties an AI-agent mistake to a real PyPI malware publication and real downstream compromise. Anthropic deserves direct incident-report credit, while Aikido, StepSecurity, and public package trackers deserve the follow-on work that converged on anthropickit==999.9.9 as the most plausible artifact. Operationally, it belongs with the AUR malware wave, Joyfill’s npm compromise, and the earlier AsyncAPI require-time compromise: the danger starts when the package manager executes code, not when the application team later reviews runtime behavior.
The key thing to remember is that the suspected package is technically simple and still dangerous. A top-level setup.py path that reads ~/.ssh, filters secret-shaped environment variables, writes /tmp/runner_exfil.json, and posts data to a webhook is enough to turn a CI or scanner host into a credential-loss event. That makes the incident more important as a lesson in execution boundaries than as a lesson in malware sophistication.
Joyfill beta npm releases turned module import into a blockchain-resolved RAT chain
Joyfill deserves continued attention because it is another reminder that lifecycle hooks are no longer the only place to look for package compromise. Socket deserves first public reverse-engineering credit, while StepSecurity added valuable follow-on validation of the wider 2773 prerelease line. What makes this story useful for defenders is that the malicious code lives in the bundle and fires on import, then resolves later stages through public blockchain transactions before spawning a detached Node process. That puts Joyfill in the same operational family as ViteVenom, the AUR build-path malware wave, and the AsyncAPI compromise.
The practical lesson is that “npm install --ignore-scripts” is not a general-purpose answer anymore. If execution starts on require() or import, every SSR path, test run, CLI helper, and bundler job becomes part of the attack surface.
CVE-2026-53264: Linux net/sched tc_action race turns local filter access into root
This is the period’s most important pure Linux vulnerability because the late-July exploit analysis turned a patch-note kernel bug into a concrete local-root model defenders can actually plan around. STAR Labs deserves exploit-analysis credit, while structured vulnerability metadata and stable-kernel references now align on the fixed ranges: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13. The bug belongs beside RefluXFS, Bad Epoll, and this week’s AUR malware wave: once a dependency incident or build-path compromise lands local code execution, the kernel can still provide the second stage.
The most important detail is architectural, not just numerical. The vulnerable path let RTM_NEWTFILTER race RTM_DELTFILTER around a shared tc_action, so an RCU-protected lookup could still hit a freed object before the delete path deferred kfree(). Defenders should read that as a reminder that “local-only” kernel issues still matter urgently on developer Linux boxes, self-hosted runners, and shared engineering hosts.
Other news:
- I did not find a stronger new package-registry or Linux story from the required sources in the last three days that justified a separate non-duplicate deep dive beyond the four items above.
- For adjacent context, revisit the 28 July briefing, the 21 July briefing, and companion research on Atomic Arch, ViteVenom, and the AsyncAPI compromise.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.