Microsoft engineer Andres Freund accidentally found the malicious code in versions of the XZ Utils compression tool, likely preventing thousands of infections
Yesterday's discovery of the xz backdoor was an accident. But what a fortunate accident it was.
Security BoulevardMike Larkin
Context & Ripple Effects
The discovery followed reports that compromised XZ Utils releases had reached Linux distributions including Debian and Red Hat. The subsequent attack timeline traced the project compromise back to late 2021, making the incident more than a single bad release.
Freund’s finding matters because it interrupted a backdoor path before it could become broadly deployed. Later, the Open Source Security Foundation and OpenJS Foundation warned that the attempt may not be isolated, extending the concern from XZ Utils to open-source supply-chain stewardship.
First-order effects
Linux distributors and users of the affected XZ Utils versions must treat those releases as compromised, replacing or reviewing them rather than relying on normal package trust.
The accidental detection prevented the backdoor from progressing into the wider infections described in the report, while putting maintainers’ release and review practices under immediate scrutiny.
Second-order effects
Organizations consuming Linux distributions will increase scrutiny of inherited packages and update paths, because a low-level compression dependency can create risk well beyond its direct users.
Open-source maintainers and distribution teams face pressure to add review capacity and provenance checks around critical projects, particularly where a small maintainer base supports widely distributed code.
Third-order effects
If similar attempts continue, software supply-chain security will shift from trusting package reputation alone toward stronger verification of maintainer, release, and build integrity.
The episode strengthens the case that critical open-source infrastructure needs sustained security support; the foundations’ warning suggests the risk is systemic rather than unique to one utility.
The trend: XZ Utils is a salient case in the broader move to harden the open-source software supply chain at its most trusted, least visible dependencies.
I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf una…
Sad prediction: as long as disaster is averted by the heroic efforts of unpaid volunteers, people who measure success in dollars will consider the system to be working correctly as is, so because it was caught before it could do catastrophic damage by volunteer effort, the xv rev…
One more aspect that I think emphasizes the number of coincidences that had to come together to find this: — I run a number “buildfarm” instances for automatic testing of postgres. Among them with valgrind. For some other test instance I had used -fno-omit-frame-pointer for s…
Afaict valgrind would not have complained about the payload without -fno-omit-frame-pointer. It was because _get_cpuid() expected the stack frame to look a certain way. — Additionally, I chose to use debian unstable to find possible portability problems earlier. Without that …
I accidentally found a security issue while benchmarking postgres changes. — If you run debian testing, unstable or some other more “bleeding edge” distribution, I strongly recommend upgrading ASAP. — https://www.openwall.com/...
Every time something like this happens I wonder what I'm even doing in this field 😅 because what do you mean you're micro-benchmarking your SSH connection
The xz backdoor was initially caught by a software engineer at Microsoft. He noticed 500ms lag and thought something was suspicious. This is the Silver Back Gorilla of nerds. The internet final boss. [image]