--- title: AUR attack escalates, Linux 7.2 merge window closes description: A weekly roundup covering several major open source and Linux ecosystem developments. The AUR supply chain attack escalated significantly, with over 1,500... canonical: https://daily.dev/posts/aur-attack-escalates-linux-7-2-merge-window-closes-g7czoy7qn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AUR attack escalates, Linux 7.2 merge window closes | daily.dev og:description: A weekly roundup covering several major open source and Linux ecosystem developments. The AUR supply chain attack escalated significantly, with over 1,500... og:url: https://daily.dev/posts/aur-attack-escalates-linux-7-2-merge-window-closes-g7czoy7qn og:image: https://api.daily.dev/og/posts/g7cZOY7qN.png og:image:alt: AUR attack escalates, Linux 7.2 merge window closes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AUR attack escalates, Linux 7.2 merge window closes **[Open Source Digest](https://daily.dev/sources/opensource_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary A weekly roundup covering several major open source and Linux ecosystem developments. The AUR supply chain attack escalated significantly, with over 1,500 packages compromised, obfuscated malware waves, Russian spam injected into shell configs, and Arch Linux suspending new account registrations. The Linux 7.2 merge window closed with Cache Aware Scheduling for AMD EPYC and Intel Xeon 6, the final removal of strncpy after six years, Apple M3 booting to a serial console in mainline, and multiple filesystem and pipe throughput improvements. KDE Plasma 6.7 shipped with per-screen virtual desktops (a 21-year-old request), Intel GPU CPU usage reductions, and a CSS-based theming preview. Godot 4.7 arrived with HDR output support, a new Asset Store, and Android export improvements. Notable items include OpenAI joining the Rust Foundation as a Platinum Member, pgAdmin 4 patching seven CVEs including an RCE, curl pausing vulnerability reports for July, Epic Games open-sourcing Lore (a VCS for large binary assets), and SteamOS 3.8.10 setting Wayland as default. ## Content **TLDR:** The AUR supply chain attack from last week kept getting worse — over 1,500 packages compromised, new waves of obfuscated malware, Russian spam injected into shell configs, and Arch locking down new account registrations entirely. Meanwhile the Linux 7.2 merge window closed with a dense batch of improvements: Cache Aware Scheduling for AMD EPYC and Intel Xeon 6, strncpy finally gone after six years and 362 commits, and Apple M3 booting to a serial console for the first time. KDE Plasma 6.7 shipped with per-screen virtual desktops after 21 years, and Godot 4.7 landed with HDR output and a new asset store. --- ## AUR attack escalates: new waves, Russian spam, account lockdown The Atomic Arch supply chain attack from last week did not stop. Attackers pushed additional waves with obfuscated hex-encoded payloads and hidden Bun invocations, then started injecting Russian-language spam and profanity into shell startup files (bashrc, zshrc, fish config) via post-install scripts. An AI-powered detection bot by Nicolas Boichat identified over 70 packages carrying the spam content. Arch Linux suspended new AUR account registrations entirely to contain the damage. Yay v13 responded with PKGBUILD last-modified timestamps in search results and Lua-based hooks for automating package review at install time. If you run an Arch-based system and haven't audited recently installed AUR packages, now is the time. [Read more](https://daily.dev/feed-by-ids?id=e2a7ZfKo1&id=qtLgTJtvX&id=IM91b6ujD&id=Sl3o5qvr9&id=yjJASHGm1&id=15aai2N63&id=7doWo2PQ8&id=XHUC1wLPr) ## Linux 7.2 merge window closes with Cache Aware Scheduling, strncpy removal, and Apple M3 boot The Linux 7.2 merge window closed with a lot packed in. Cache Aware Scheduling landed under CONFIG_SCHED_CACHE, co-locating tasks that share data within the same LLC domain — relevant for AMD EPYC and Intel Xeon 6 multi-LLC setups. The six-year, 362-commit effort to remove strncpy from the kernel is done; use strscpy() going forward. Apple M3 now boots to a serial console in mainline, alpha quality only with no GPU support. The AF_ALG crypto interface is being deprecated after a root-access vulnerability. Btrfs large folios are enabled by default with single-digit percentage real-world gains, and a three-line iomap fix delivers roughly 5% IOPS improvement on ext4 and XFS over NVMe. Anonymous pipe writes got 6–28% throughput improvement by moving page allocation outside the pipe lock. [Read more](https://daily.dev/feed-by-ids?id=sEl6lCWdY&id=2B5Ujn2lK&id=Kuu7wPALj&id=D0o4cOjrm&id=MtGECUkDr&id=4Fns0MKaJ&id=NX631VSmN&id=7ZUldztbv&id=bOcJRdbbH&id=cjhZJzWjo) ## KDE Plasma 6.7 ships per-screen virtual desktops after 21 years KDE Plasma 6.7 is out with independent per-screen virtual desktops, a feature that's been requested since KDE 3. Intel GPU users get up to 70% CPU usage reduction for CPU-rendered apps via hardware overlay planes in KWin. The release also brings simultaneous HDR and ICC color profile support, the revived Oxygen and Air themes from KDE 4, and Union as a tech preview — a CSS-based theming layer that targets Plasma, QtQuick, and QtWidgets apps with a single stylesheet. Plasma 6.8 will drop the X11 session entirely, which is why SonicDE exists now as a fork maintaining X11 KWin support. [Read more](https://daily.dev/feed-by-ids?id=8xqGWSKxu&id=1psKLhGbZ&id=u7zv0D15Y&id=VYffQPEbd&id=douAuN9nE&id=9KptP6WXT) ## Godot 4.7 released with HDR output and new asset store Godot 4.7 is out, contributed to by over 300 developers across 1,600 pull requests. HDR output now works on Windows, macOS, iOS, visionOS, and Linux (Wayland only, not X11), finally letting games use the full range of modern displays after years of internal HDR rendering capped at SDR output. A new AreaLight3D node handles rectangular light sources for TVs, windows, and billboards. The old Asset Library is replaced by a new Asset Store with background threading and improved browsing. The Godot Android Build Environment (GABE) reaches stable, enabling full export and publishing on Android without a desktop machine. Over 700 new Godot games have shipped on Steam in 2026 so far. [Read more](https://daily.dev/feed-by-ids?id=llWf3Zf18&id=E7ZD1OR1h&id=epPwK7Uk3&id=oo92cpuU8&id=CpAKjXgXo&id=TMfHpNSdd) --- ## Also notable - **OpenAI joins Rust Foundation as Platinum Member with $600K commitment:** OpenAI is joining the Rust Foundation as a Platinum Member with $600,000 in total contributions, placing Predrag Gruevski (cargo-semver-checks maintainer) on the board, and separately committing $160K to sponsor maintainers behind Astral and related projects plus 3,000 free ChatGPT Pro plans for open source maintainers. [Read more](https://daily.dev/feed-by-ids?id=Uv7dNaMI3&id=LYrgmoXdf&id=NVSjTEL1Y&id=wnxSyhcB8&id=ClisnckQN) - **pgAdmin 4 v9.16 patches seven CVEs including RCE via AI Assistant:** pgAdmin 4 v9.16 fixes CVE-2026-12044 through CVE-2026-12050, including an AI Assistant read-only transaction bypass that enabled RCE via COPY TO PROGRAM, SQL injection in dialog templates, unauthenticated SQL Editor endpoints with a pickle deserialization sink, and stored XSS allowing credential exfiltration. [Read more](https://daily.dev/posts/43lcqxnYC) - **curl pauses vulnerability reports July 1 through August 3, 2026:** Daniel Stenberg is closing curl's HackerOne form and security email for the month of July, citing sustained maintainer pressure over the past four months; the curl 8.22.0 release is pushed back two weeks to September 2, 2026, and paid support contract holders remain covered. [Read more](https://daily.dev/feed-by-ids?id=LnG7oLbrg&id=IDWwcmETt) - **Epic Games releases Lore, an MIT-licensed VCS built for large binary assets:** Epic Games open-sourced Lore (v0.8.3, MIT license), the version control system underlying UEFN, designed for game projects with multi-gigabyte binary files — featuring chunked storage, fragment-level deduplication, sparse lazy working copies, and multi-tenant isolation where Git with LFS falls short. [Read more](https://daily.dev/feed-by-ids?id=KF7TRYg6H&id=XafA8Zvp2&id=Hda9NhyD9&id=zZUB3lQNb) - **SteamOS 3.8.10 stable sets Wayland as default desktop mode, adds Steam Machine support:** SteamOS 3.8.10 ships KDE Plasma 6.4, Linux 6.16, LAVD CPU scheduler support, Wayland as the default in desktop mode (X11 still available), and initial support for the upcoming Steam Machine hardware. [Read more](https://daily.dev/posts/Mf1px3yTf) ## Similar posts on daily.dev - [Arch Linux AUR Malware, Linux 7.2 Developments & Other June Highlights](https://daily.dev/posts/arch-linux-aur-malware-linux-7-2-developments-other-june-highlights-4khcuvqgc) · Phoronix · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#godot](https://daily.dev/tags/godot) [View this post on daily.dev](https://daily.dev/posts/aur-attack-escalates-linux-7-2-merge-window-closes-g7czoy7qn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/aur-attack-escalates-linux-7-2-merge-window-closes-g7czoy7qn","headline":"AUR attack escalates, Linux 7.2 merge window closes","text":"A weekly roundup covering several major open source and Linux ecosystem developments. The AUR supply chain attack escalated significantly, with over 1,500 packages compromised, obfuscated malware waves, Russian spam injected into shell configs, and Arch Linux suspending new account registrations. The Linux 7.2 merge window closed with Cache Aware Scheduling for AMD EPYC and Intel Xeon 6, the final removal of strncpy after six years, Apple M3 booting to a serial console in mainline, and multiple filesystem and pipe throughput improvements. KDE Plasma 6.7 shipped with per-screen virtual desktops (a 21-year-old request), Intel GPU CPU usage reductions, and a CSS-based theming preview. Godot 4.7 arrived with HDR output support, a new Asset Store, and Android export improvements. Notable items include OpenAI joining the Rust Foundation as a Platinum Member, pgAdmin 4 patching seven CVEs including an RCE, curl pausing vulnerability reports for July, Epic Games open-sourcing Lore (a VCS for large binary assets), and SteamOS 3.8.10 setting Wayland as default.","url":"https://daily.dev/posts/aur-attack-escalates-linux-7-2-merge-window-closes-g7czoy7qn","datePublished":"2026-06-22T04:20:11.758Z","dateModified":"2026-06-22T04:20:33.164Z","author":{"@type":"Organization","name":"Open Source Digest","logo":"https://media.daily.dev/image/upload/s--9lMKiPTq--/f_auto,q_auto/v1773839407/logos/opensource_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/opensource_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/opensource_digest","name":"Open Source Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Open Source Digest","item":"https://daily.dev/sources/opensource_digest"},{"@type":"ListItem","position":3,"name":"AUR attack escalates, Linux 7.2 merge window closes"}]} ```