Loading story…
Debian issued DSA 5649-1 for xz-utils, publishing a security update for the compression package in supported distributions. The advisory identified a vulnerability in xz-utils and directed users to install updated packages through Debian security channels to remediate the issue.
Later disclosures about a backdoor in certain XZ releases prompted broader scrutiny across Unix-like systems, but FreeBSD said it was not affected by the malicious code found in those upstream releases. Together, the notices show parallel security activity around xz-utils: Debian distributing patched packages for its own tracked flaw, and FreeBSD confirming its exposure did not include the subsequently disclosed upstream backdoored versions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The upstream XZ Utils project published review notes related to the xz backdoor incident. The publication represents a later official technical update from the project following the March disclosure.
FreeBSD published a security notice about the disclosed backdoor in xz releases and said FreeBSD was not affected. This reflects the public disclosure and vendor response captured in the reference.
Debian published security advisory DSA 5649-1 for xz-utils, announcing a security update for the package. This is the earliest concrete event referenced in the provided materials.
A Debian bug report for xz-utils was filed noting that a new upstream version was available. This reflects a distinct Debian package maintenance event shortly before the public xz backdoor disclosure wave.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
binarly.io
Open sourcetukaani.org
Open sourceopenwall.com
Open sourcelists.freebsd.org
Open sourcebugs.debian.org
Open sourceweb.archive.org
Open sourcelists.debian.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious backdoor was discovered in **XZ Utils**, a widely used compression library, and assigned **`CVE-2024-3094`**, raising urgent concerns about software supply chain compromise across Linux environments. The tampered code was introduced into upstream release tarballs for versions **5.6.0** and **5.6.1** and could enable unauthorized remote code execution by subverting authentication workflows in systems using affected `liblzma` packages, particularly where `sshd` was linked through `systemd` integrations. Security teams were urged to identify vulnerable builds, downgrade to trusted versions, and verify package provenance across development and production systems. The incident renewed attention on the broader risk posed by foundational open-source components becoming attack vectors, echoing the long-tail impact of major infrastructure flaws such as **`CVE-2021-44228`** in **Apache Log4j**. While unrelated technically, both cases underscored how deeply embedded dependencies can create outsized enterprise exposure when compromised. Organizations were advised to strengthen software bill of materials validation, monitor upstream package integrity, and accelerate patching and rollback procedures for critical third-party libraries.
Jul 12, 2026
A malicious supply-chain backdoor was discovered in **XZ Utils** versions `5.6.0` and `5.6.1`, tracked as **`CVE-2024-3094`**, after PostgreSQL developer and Microsoft engineer **Andres Freund** investigated unusual CPU behavior and traced it to `liblzma`. The tampering was hidden in release tarballs rather than plainly visible in the main Git repository, using an obfuscated **M4 macro** during the build process to generate second-stage artifacts that altered library behavior. Researchers and vendors said the poisoned build could interfere with **OpenSSH** authentication through `systemd`, creating a path for unauthorized remote access to affected Linux systems. Red Hat said **Red Hat Enterprise Linux** was not affected, but compromised packages reached **Fedora Rawhide** and **Fedora Linux 40 beta**, prompting urgent downgrade and rollback guidance to safe `5.4.x` releases; Fedora 40 reportedly did not show successful execution of the injected code. Reports also said the malicious build succeeded in **Debian unstable (Sid)**, appeared in a Debian beta branch, affected several **openSUSE** distributions, and was noted by **Kali Linux**, while stable Debian releases were not known to be impacted. The incident was widely described as a near-catastrophic attack on Linux infrastructure, with scrutiny falling on maintainer account **Jia Tan / JiaT75** and an apparent long-running social-engineering effort to gain influence over the project.
Jun 29, 2026
A malicious backdoor was discovered in **xz Utils**, a widely used compression library embedded in many Linux distributions, after software engineer **Andres Freund** investigated unusual performance issues tied to `ssh`. Researchers said the tampered release could have allowed attackers to hijack SSH authentication and execute code on affected machines, creating a stealthy compromise path into Linux servers and downstream infrastructure. The affected version had been published but was not yet broadly deployed, and maintainers moved quickly to issue fixes after the disclosure. Evidence cited by investigators indicates the attacker, operating under the pseudonym **"Jia Tan,"** spent years building credibility in the open-source project before gaining maintainer influence and inserting the backdoor, making the incident one of the most serious recent software supply-chain threats. The operation's sophistication prompted speculation that a nation-state actor may have been involved, and the case renewed concern over covert interception techniques resembling earlier reports of man-in-the-middle targeting of major internet services.
Jun 29, 2026