Red Hat Warns of Malware Code Embedded in Popular Linux Tool Allow Unauthorized Access to Systems

Red Hat warns of a critical supply-chain compromise (CVE-2024-3094) in xz compression tools (v5.6.0 and v5.6.1) where an obfuscated M4 macro in distribution packages injects second-stage malicious code that can alter library behavior and enable SSH authentication bypass via systemd, potentially granting unauthorized remote access. Affected builds include Fedora Rawhide, Fedora 40 beta (presence noted), Debian unstable, and several openSUSE distributions; Red Hat and distributors advise immediate downgrade to xz-5.4.x and suspending use of compromised builds.