Whispers of XZ Utils Backdoor Live on in Old Docker Images

Researchers report that the high-severity XZ Utils backdoor (CVE-2024-3094) — previously removed after disclosure — persists in a number of Debian-based Docker Hub images; Binarly identified 35 affected images (12 direct, 23 second-order). While maintainers and registries mitigated widespread impact and exploitability is limited by several unlikely conditions (old tags, running a system and SSH inside the container), the presence of backdoored builds in public registries poses a lasting supply-chain risk and demonstrates how short-lived compromises can persist in container ecosystems.