Loading story…
A malicious backdoor was discovered in xz Utils, a widely used compression library embedded in many Linux distributions, after software engineer Andres Freund investigated unusual performance issues tied to ssh. Researchers said the tampered release could have allowed attackers to hijack SSH authentication and execute code on affected machines, creating a stealthy compromise path into Linux servers and downstream infrastructure. The affected version had been published but was not yet broadly deployed, and maintainers moved quickly to issue fixes after the disclosure.
Evidence cited by investigators indicates the attacker, operating under the pseudonym "Jia Tan," spent years building credibility in the open-source project before gaining maintainer influence and inserting the backdoor, making the incident one of the most serious recent software supply-chain threats. The operation's sophistication prompted speculation that a nation-state actor may have been involved, and the case renewed concern over covert interception techniques resembling earlier reports of man-in-the-middle targeting of major internet services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Following disclosure, researchers said the sophistication of the operation suggested a highly capable actor, with some speculating that only a nation-state such as Russia or China could have carried it out. The true identity of the attacker remained unknown.
After Freund disclosed his findings, developers produced a fix for the compromised xz Utils release. The affected version had been published but was not yet widely deployed.
While investigating unusual SSH-related performance behavior during routine testing, software engineer Andres Freund identified the malicious backdoor in xz Utils. His discovery exposed what researchers described as a potentially massive and stealthy supply-chain attack.
A malicious backdoor was inserted into xz Utils, a compression library used on Linux systems. The backdoored release could have enabled attackers to hijack SSH connections and execute code on affected machines.
Evidence cited in the reference indicates the person using the pseudonym 'Jia Tan' spent years cultivating trust within the xz Utils open-source project before later becoming a maintainer. This long-term access set the stage for a supply-chain compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious supply-chain backdoor was discovered in **XZ Utils** versions `5.6.0` and `5.6.1`, tracked as **`CVE-2024-3094`**, after PostgreSQL developer and Microsoft engineer **Andres Freund** investigated unusual CPU behavior and traced it to `liblzma`. The tampering was hidden in release tarballs rather than plainly visible in the main Git repository, using an obfuscated **M4 macro** during the build process to generate second-stage artifacts that altered library behavior. Researchers and vendors said the poisoned build could interfere with **OpenSSH** authentication through `systemd`, creating a path for unauthorized remote access to affected Linux systems. Red Hat said **Red Hat Enterprise Linux** was not affected, but compromised packages reached **Fedora Rawhide** and **Fedora Linux 40 beta**, prompting urgent downgrade and rollback guidance to safe `5.4.x` releases; Fedora 40 reportedly did not show successful execution of the injected code. Reports also said the malicious build succeeded in **Debian unstable (Sid)**, appeared in a Debian beta branch, affected several **openSUSE** distributions, and was noted by **Kali Linux**, while stable Debian releases were not known to be impacted. The incident was widely described as a near-catastrophic attack on Linux infrastructure, with scrutiny falling on maintainer account **Jia Tan / JiaT75** and an apparent long-running social-engineering effort to gain influence over the project.
Jun 29, 2026
A malicious backdoor was discovered in **XZ Utils**, a widely used compression library, and assigned **`CVE-2024-3094`**, raising urgent concerns about software supply chain compromise across Linux environments. The tampered code was introduced into upstream release tarballs for versions **5.6.0** and **5.6.1** and could enable unauthorized remote code execution by subverting authentication workflows in systems using affected `liblzma` packages, particularly where `sshd` was linked through `systemd` integrations. Security teams were urged to identify vulnerable builds, downgrade to trusted versions, and verify package provenance across development and production systems. The incident renewed attention on the broader risk posed by foundational open-source components becoming attack vectors, echoing the long-tail impact of major infrastructure flaws such as **`CVE-2021-44228`** in **Apache Log4j**. While unrelated technically, both cases underscored how deeply embedded dependencies can create outsized enterprise exposure when compromised. Organizations were advised to strengthen software bill of materials validation, monitor upstream package integrity, and accelerate patching and rollback procedures for critical third-party libraries.
Jul 12, 2026
A severe flaw in **PuTTY** and several applications that reuse its code can expose private keys used with the NIST P-521 `ECDSA` algorithm. The weakness causes the software to generate insufficiently random nonces, allowing an attacker to recover a victim’s private key after collecting roughly 60 signatures from the vulnerable implementation. The issue affects PuTTY as well as tools including **FileZilla**, **WinSCP**, and **TortoiseGit**; users of **TortoiseSVN** were advised to replace `Plink` with the latest PuTTY version until an official fix becomes available. Organizations were urged to update immediately and treat any affected P-521 key pairs as potentially compromised because recovered keys could be reused for SSH authentication or other trusted public-key access. Separately, a critical compromise in **XZ Utils** introduced malicious code into versions `5.6.0` and `5.6.1`, creating a supply-chain backdoor that could enable unauthorized access on affected Linux systems, with **SSH** identified as a primary exposure path. Defenders were advised to downgrade to version `5.4.6` immediately, consider disabling SSH if rollback was not possible, and verify system integrity because patching alone may not be enough if the backdoor was already exploited. The alerts noted that some Linux distributions had shipped the tainted versions while others were not observed to be vulnerable or had already issued updates.
Jun 29, 2026