Weekly Threat Intelligence: AUR Hijack, PAM Backdoor, and the Supply Chain Crisis of June 2026

Three supply chain campaigns in one week — 400+ hijacked AUR packages, a nine-year Linux PAM backdoor, and fresh KEV entries for Oracle and Ivanti. The June 2026 lesson: trust itself is the attack surface.

The Week in Breaches: Trust Is the Attack Surface

June 2026 continues a grim trend: attackers target the trust chain itself rather than individual software flaws. This week brought three distinct supply chain campaigns — each designed to abuse the implicit trust defenders place in familiar tools, maintainers, and update mechanisms. For the prior weeks’ coverage, see Week 1 and the Week 2 digest; the full-month picture is in the June threat landscape briefing.

1. Arch Linux AUR Hijack: 400+ Packages Weaponized

Over 400 packages in the Arch User Repository were compromised when attackers took over legitimate maintainer accounts and silently rewrote build scripts. The malicious build process deployed a Rust-based credential stealer and — when run with root privileges — an eBPF rootkit for kernel-level persistence. Compromised packages kept their names, histories, and maintainer identities; only the build instructions changed. The official Arch repositories were unaffected.

Defender takeaway: this is not a software vulnerability — it’s a trust model vulnerability. Package managers and CI/CD pipelines need to verify build scripts on every update, not just the resulting binaries. Full anatomy in our AUR hijack deep-dive.

2. Velvet Ant: Linux PAM Backdoored for Nearly a Decade

Sygnia researchers disclosed a campaign by a China-nexus group tracked as Velvet Ant that spent nearly nine years hidden inside Linux login infrastructure. Instead of deploying detectable malware, the group replaced core PAM (Pluggable Authentication Modules) and OpenSSH components with backdoored versions.

• Backdoored PAM modules allowed attacker authentication via secret passwords
• Some variants recorded all legitimate credentials as users logged in
• Nine separate backdoor versions were discovered across the network
• Initial access traces date back to 2016
• The targeted network had no direct internet access — attackers staged through internet-facing systems first

Detection challenge: the modifications lived in trusted login binaries themselves, so standard endpoint detection and file integrity monitoring often flagged the changes as legitimate updates. Organizations should implement continuous integrity verification of critical system binaries (PAM, SSH, sudo) and monitor for anomalous login patterns — especially credentials in use from impossible geographies.

3. CISA KEV: Oracle and Ivanti Entries

CISA added two new entries to its Known Exploited Vulnerabilities catalog this week — both with confirmed active exploitation and federal remediation deadlines under BOD 26-04:

The Ivanti flaw is exploitable when endpoints are externally reachable without mTLS/EPMM protection — audit your exposure accordingly. See also our earlier June KEV analysis for the month’s other additions.

4. Fortinet FortiSandbox Critical RCE

Fortinet patched a critical remote code execution vulnerability in FortiSandbox allowing unauthenticated attackers to execute commands via crafted HTTP requests. Given FortiSandbox’s role in malware analysis pipelines, compromise doesn’t just breach a host — it can blind an organization’s threat detection capabilities by controlling the verdicts the SOC relies on. Patch immediately; verify sandbox verdict logs for anomalies in the interim.

Defender Playbook: Hardening Against Supply Chain Attacks

1. Verify build integrity: implement reproducible builds and diff build scripts between versions — not just binaries
2. Monitor critical binaries: file integrity monitoring on PAM modules, SSH binaries, and sudo configurations, with baseline comparisons against vendor signatures
3. Segment access: ensure internet-facing systems cannot directly reach critical internal infrastructure — the Velvet Ant staging pattern depends on this bridge
4. Pin dependencies: lock package versions and require manual review for updates in CI/CD pipelines
5. Track the KEV catalog: subscribe to CISA’s feed and automate patch prioritization for new entries
6. Audit mTLS enforcement: for products like Ivanti Sentry, verify external endpoints require mutual TLS or EPMM protection

Frequently Asked Questions

What happened in the Arch Linux AUR hijack?

Attackers took over maintainer accounts for 400+ packages in the Arch User Repository and rewrote their PKGBUILD build scripts to deploy a Rust credential stealer — plus an eBPF rootkit wherever builds ran as root. Package names, versions, and histories stayed identical, so normal updates looked clean. Anyone who built or updated an AUR package on or after June 11, 2026 should verify against the affected package lists and rotate credentials.

What is the Velvet Ant PAM backdoor?

A China-nexus APT campaign disclosed by Sygnia: the group replaced Linux PAM and OpenSSH components with backdoored versions that accepted secret attacker passwords and, in some variants, recorded every legitimate credential at login. Nine backdoor versions persisted across a network with initial access traces dating to 2016 — surviving because the changes lived inside trusted authentication binaries.

Which CISA KEV entries were added this week?

CVE-2026-35273 (Oracle PeopleSoft Enterprise PeopleTools, missing authentication for a critical function enabling unauthenticated takeover; added June 12, 2026 with a June 15 remediation deadline) and CVE-2026-10520 (Ivanti Sentry OS command injection yielding unauthenticated root RCE when the appliance is in an unmanaged state without mTLS/EPMM protection). Both are actively exploited.

Why is a FortiSandbox RCE especially dangerous?

FortiSandbox sits inside malware analysis pipelines: whoever controls it controls the verdicts your SOC trusts. A compromise can both breach the host and silently reclassify malicious samples as clean — blinding detection while appearing operational. Patch immediately and review historical verdict logs for anomalies.

References

• Sygnia — Velvet Ant Linux PAM backdoor research
• CISA — Known Exploited Vulnerabilities catalog, June 2026 additions
• Fortinet — FortiSandbox critical security advisory
• Hmmnm — Over 400 Arch Linux AUR Packages Hijacked
• Hmmnm — Weekly Threat Intel June 2026 — Week 1
• Hmmnm — Threat Intel Weekly June 2026 — Week 2
• Hmmnm — CISA KEV June 2026: Android, Palo Alto, Oracle
• Hmmnm — Cybersecurity Threat Landscape June 2026