Daily AcreetionOS Update -- October 24, 2026

Fake Arch Linux packages hid scripts that could run attacker-controlled code as root, raising serious security alarms across the community.

Development

The security community went into overdrive this week after Bitdefender, BleepingComputer, and other outlets exposed a campaign distributing trojanized packages that appeared legitimate but contained malicious payloads capable of gaining root privileges on vulnerable systems. AcreetionOS's security team is working with upstream Arch maintainers to verify our package signing infrastructure and ensure no compromise in our own repositories. We're also updating our verification docs to help users double-check package integrity. You can track these security measures in our changelog at https://acreetionos.org/changelog.html.

Community

Shelly 3.1.9 arrived with significant AUR support improvements and new file migration tools, making it easier than ever for AcreetionOS users to manage packages from the Arch User Repository. Community member cobra3282000 has been testing the new migration features and reports excellent results on his development machine. Darren continues his work on Calamares customization, preparing for the next stable ISO release that will include Shelly 3.1.9 by default.

Tip of the day

Always verify package signatures before installation, especially for AUR packages. Run pacman -Syu && sudo pacman -S --needed base-devel first, then use makepkg -si with the --sign flag when building from the AUR. Check our wiki guide on package security at https://acreetionos.org/wiki.html for step-by-step verification procedures.