Malicious backdoor in xz/liblzma (supply-chain compromise)

A backdoor was intentionally introduced into the xz-utils upstream release tarballs (5.6.0 / 5.6.1). When linked into sshd via liblzma, it allows a remote attacker holding a specific key to bypass authentication and execute commands.

▾ Midnight zone — Critical, or high with PoC / in-the-wild