1 story taggedeBPF rootkit.
Attackers rewrote build scripts in Arch's community repo to drop a secret-harvesting binary, with an eBPF rootkit waiting if it gets root.