Andres Freund, a Microsoft software engineer, discovered a backdoor lurking in the XZ utils data-compression tools, which are open source and widely  used across Linux distributions. The backdoor was just about to be added to major Linux operating systems. Last Friday, 3/29/2024, Andres noticed the backdoor by chance while benchmarking a Linux-based Debian installatiion. During the tests he realized that XZ utils was triggering high CPU consumption with SSH processes, the security protocol for logging into a remote server. This led him to realize that a component within XZ utils can inject unauthorized code into a Linux installation to spy on the user's computer and execute additional malicious code, according to security researchers.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  In response, Linux OS providers Red Hat and Debian have issued security advisories warning users about the threat. But in some good news, the stable versions of Red Hat Linux and Debian never incorporated the malicious XZ utils components. Instead, the backdoor only made its way to the Red Hat Fedora 40 beta and Fedora Rawhide, along with experimental distributions for Debian. Any affected users should immediately downgrade their XZ utils version. Specificially, this code is present in versions 5.6.0 and 5.61 of the XZ libraries, Red Hat says. Meanwhile, US cyber authorities are urging affected users to "downgrade XZ utils to an uncompromised version-such as XZ utils 5.4.6 Stable" and hunt for any mailicious activity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      In this case, the backdoor has been traced to a mysterious user called Jia Tan or Jia T75, who submitted the malicious changes to XZ utils. Cryptography expert Filippo Valsorda added:  "This might be the best executed supply chain attack we've seen described in the open and it's a nightmare scenerio. Malicious, competent, authorized upstream in a widely used library."