stable release of Arch Linux is also affected. That distribution, however, isn't used in production systems.

Don't tell me how to live my life, Ars Technica.

This was basically a lucky catch. Sadly makes you wonder how many backdoors like that have not been found (yet). Never the less the distro model of not feeding in upstream binaries directly is an important part of the multi-barrier security.

Catching this now is pretty huge, because it mainly targets distro build systems. Had this gone undetected, we'd be in shiznit creek couple of years down the line.

For those on Android running Termux, it is also affected. Just checked my version of xz-utils and it was 5.6.1. Running "pkg upgrade" will roll back to version 5.4.5 (tagged as "5.6.1+really5.4.5" for both liblzma and xz-utils packages).

This is the best summary I could come up with:

Researchers have found a malicious backdoor in a compression tool that made its way into widely used Linux distributions, including those from Red Hat and Debian.

An update the following day included a malicious install script that injected itself into functions used by sshd, the binary file that makes SSH work.

So-called GIT code available in repositories aren’t affected, although they do contain second-stage artifacts allowing the injection during the build time.

In the event the obfuscated code introduced on February 23 is present, the artifacts in the GIT version allow the backdoor to operate.

“This could break build scripts and test pipelines that expect specific output from Valgrind in order to pass,” the person warned, from an account that was created the same day.

The malicious versions, researchers said, intentionally interfere with authentication performed by SSH, a commonly used protocol for connecting remotely to systems.

The original article contains 810 words, the summary contains 146 words. Saved 82%. I'm a bot and I'm open source!

Just makes you wonder what else (if anything) is backdoored. I am seriously 🤏 this close to just switching all of my boxes over to OpenBSD.

The last time someone over there was approached about backdooring a related piece of software (which they refused), the OpenBSD devs manually screened the entire codebase, just in case something got in.

Really, the only things I'd miss would be Minecraft, KDE, and Mullvad Browser; and of course I'd have to buy a couple more WiFi dongles (or learn how to port drivers from Linux).