“The upstream xz repository and the xz tarballs have been backdoored.”
Andres Freund noticed ssh logins on Debian sid taking 0.8 seconds instead of 0.3 and pulled the thread. The payload hid in test files, and the trigger lived only in the release tarballs, not in git. It fired only in Debian and RPM package builds on x86-64 with gcc, and hooked RSA_public_decrypt in sshd through a systemd patch that openssh upstream never shipped. The committer spent weeks fixing the backdoor’s valgrind errors in public. Half a second of CPU caught what every distro review missed.