[chud]

The upstream xz repository and the xz tarballs have been backdoored.

Sources:
https://www.bleepingcomputer.com/news/se...x-distros/
https://www.openwall.com/lists/oss-secur...24/03/29/4
https://archlinux.org/news/the-xz-packag...ackdoored/
https://news.ycombinator.com/item?id=39865810
https://seclists.org/oss-sec/2024/q1/268
https://www.gamingonlinux.com/2024/03/xz...cal-issue/

liblzma and xz version 5.6.0 and 5.6.1 are vulnerable to arbitrary code execution. If you are running Debian sid, Fedora 41, Fedora Rawhide, openSUSE Tumbleweed, or openSUSE MicroOS, run updates now.

[trappednever1]

One has to wonder if a similar event has happened before.....

[gentle]

All the time. Look up the famous acid bitches backdoor for a good example.

[Church]

The real question is why do we allow today binary files in tests that are not built in the testing faze.