--- title: Best BleepingComputer posts — June 2026 | daily.dev description: The most upvoted BleepingComputer posts from June 2026, curated by the daily.dev community. canonical: https://daily.dev/sources/bleepingcomputer/best-of/2026/06 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/bleepingcomputer/best-of/2026/06 og:type: website og:site_name: daily.dev og:title: Best BleepingComputer posts — June 2026 | daily.dev og:description: The most upvoted BleepingComputer posts from June 2026, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of BleepingComputer — June 2026 1. 1 [](https://daily.dev/posts/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer-f7ileezok "Over 400 Arch Linux packages compromised to push rootkit, infostealer") Article BleepingComputer · 13w Over 400 Arch Linux packages compromised to push rootkit, infostealer Over 400 packages in the Arch User Repository (AUR) have been compromised to distribute a Linux rootkit and infostealer malware. Attackers spoofed trusted publishers and hijacked orphaned packages, modifying PKGBUILD scripts to install a malicious npm package called atomic-lockfile. This package drops a Linux ELF binary with credential-stealing capabilities targeting GitHub tokens, SSH keys, browser cookies, Slack, Discord, Teams, Telegram data, and more. An optional eBPF rootkit component can hide processes, files, and network interfaces at the kernel level. AUR maintainers are removing malicious commits and banning responsible accounts. Affected users are advised to rotate all credentials and consider a full reinstall, as rootkits may survive standard cleanup. 94 7 2. 2 [](https://daily.dev/posts/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack-2rfjqmxiq "New IronWorm malware hits 36 packages in npm supply-chain attack") Article BleepingComputer · 14w New IronWorm malware hits 36 packages in npm supply-chain attack A new supply-chain attack named IronWorm has compromised 36 npm packages with infostealer malware written in Rust. The malware targets 86 environment variables and 20 credential files, seeking OpenAI, AWS, Anthropic, npm credentials, SSH keys, and cryptocurrency wallet files. It hides behind an eBPF kernel rootkit, communicates via Tor, and self-propagates by using stolen npm credentials to publish trojanized package versions. The attack originated from a compromised account 'asteroiddao' and uses backdated commits to evade investigation. A novel exfiltration mechanism abuses GitHub Actions build artifacts to deliver stolen secrets without needing a traditional C2 server. Researchers at JFrog, Ox Security, and Endor Labs detected the attack early before it spread to more popular packages. Developers are advised to upgrade to fixed releases, rotate credentials, and enable 2FA. 62 21 3. 3 [](https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5 "FFmpeg fixes PixelSmash flaw in widely used video decoder") Article BleepingComputer · 11w FFmpeg fixes PixelSmash flaw in widely used video decoder A heap out-of-bounds write vulnerability (CVE-2026-8461), dubbed 'PixelSmash', has been discovered in FFmpeg's MagicYUV decoder. The flaw affects any application using libavcodec, including Kodi, OBS Studio, Nextcloud, PhotoPrism, Emby, and Jellyfin. Researchers at JFrog demonstrated full RCE against a Jellyfin 10.11.9 server by dropping a crafted AVI file into its media library, which triggers an automatic ffprobe scan that fires the exploit. RCE requires ASLR to be disabled or chained with a separate info-disclosure bug; otherwise the flaw reliably causes denial-of-service. Plex is unaffected due to a custom FFmpeg build with a minimal decoder allowlist. FFmpeg 8.1.2 (released June 17) patches the issue. The vulnerability is considered a supply-chain risk because the MagicYUV decoder is embedded in hundreds of projects that trust FFmpeg to safely handle untrusted media input. 37 4. 4 [](https://daily.dev/posts/hands-on-with-intelligent-terminal-an-ai-powered-windows-terminal-gbqmlnth6 "Hands on with Intelligent Terminal, an AI-powered Windows Terminal") Article BleepingComputer · 14w Hands on with Intelligent Terminal, an AI-powered Windows Terminal Microsoft has released an open-source fork of Windows Terminal called 'Intelligent Terminal' that integrates AI agents directly into the terminal experience. It supports multiple AI models including GitHub Copilot, Claude, Codex, and Gemini. Key features include automatic error detection and suggestion (which sends failed commands to the selected AI for fixes), and session management that lets users resume previous agent sessions — something standard Windows Terminal doesn't support. The tool is available on the Microsoft Store and GitHub but is not bundled with Windows by default. 19 2 5. 5 [](https://daily.dev/posts/new-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute-u9xatkol2 "New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute") Article BleepingComputer · 14w New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute A newly discovered DoS attack called 'HTTP/2 Bomb' combines HPACK compression amplification with HTTP/2 flow-control stalling to exhaust server RAM from a single machine on a 100 Mbps connection. Against Apache httpd and Envoy, a single client can consume 32 GB of server memory in roughly 20 seconds. The technique works against default HTTP/2 configurations of NGINX, Apache, Microsoft IIS, Envoy, and Cloudflare Pingora. Discovered by OpenAI's Codex agent under guidance from offensive security firm Calif, the attack bypasses existing header-size defenses because amplification comes from internal per-header bookkeeping. Patches have been released for nginx (1.29.8) and Apache httpd mod\_http2 (2.0.41, CVE-2026-49975), but IIS, Envoy, and Pingora remain unpatched. Mitigations include disabling HTTP/2, using CDNs/reverse proxies, and enforcing hard header-count limits. 13 [See all BleepingComputer archives](/sources/bleepingcomputer/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/bleepingcomputer/best-of/2026/06#page","url":"https://daily.dev/sources/bleepingcomputer/best-of/2026/06","name":"Best BleepingComputer Posts — June 2026","description":"The most upvoted BleepingComputer posts from June 2026, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/bleepingcomputer/best-of/2026/06#items","numberOfItems":5,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer-f7ileezok","name":"Over 400 Arch Linux packages compromised to push rootkit, infostealer"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack-2rfjqmxiq","name":"New IronWorm malware hits 36 packages in npm supply-chain attack"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5","name":"FFmpeg fixes PixelSmash flaw in widely used video decoder"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/hands-on-with-intelligent-terminal-an-ai-powered-windows-terminal-gbqmlnth6","name":"Hands on with Intelligent Terminal, an AI-powered Windows Terminal"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/new-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute-u9xatkol2","name":"New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/bleepingcomputer/best-of"},{"@type":"ListItem","position":5,"name":"June 2026"}]}]} ```