A software supply chain meltdown: What we know about the XZ Trojan

A malicious, long-running supply-chain campaign injected a backdoor into xz/liblzma release tarballs (versions 5.6.0 and 5.6.1). The backdoor unpacks obfuscated payloads during build, abuses glibc IFUNC for runtime hooking to alter OpenSSH authentication (potentially bypassing RSA auth), and targets AMD64 glibc systems on .deb/.rpm distributions; organizations are advised to revert to a known-good xz (e.g., 5.4.x), hunt for compromise, and follow CISA guidance.