Embed Notice

* And promptly snuck a backdoor into xz via the release package (*) (backdoor isn't present in code)
* On some Linux distros sshd is patched for to work with systemd (to allow other services to know when sshd is/isnt running)… and that patch links in xz('s library)…
* And now sshd is compromised - send a specially crafted xz archive to sshd and you're in…

(* edited.)