D-Link security certificates are being used to sign industry espionage malware

Two strains of Plead exist - one straightforward beastie, and one password stealer capable of lifting from Google Chrome, Microsoft Internet Explorer, Microsoft Outlook and Mozilla Firefox.

DOD seeks classification “Clippy” to help classify data, control access [iophk: "if they have Microsoft Office they have already failed security]

Malware Attack On Arch Linux AUR Repository; Three Packages Infected So Far

Arch Linux PDF reader package poisoned

Ubuntu Local Authorization Bypass Bug Likely to Never Be Fixed? [Ed: Physical access = PC compromised;  there are many other ways around it, including reboots with recovery mode, so...]

It was just reported that a bug filed on Ubuntu Launchpad (dubbed Local authorization bypass by using suspend mode) about a month ago has been confirmed by several users. The bug allows an individual with physical access to a machine to evade the lock screen simply by removing its hard drive.