corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a07df4-e11c-7221-953c-50fa107455ec

Timeline of the xz open source attack

Russ Cox · published 2 April 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at research.swtch.com Wayback capture
17blogs citing
First cited
31 Mar 2024
Most recent
25 Apr 2026
Rank this month
not ranked
Links from this post
80
Words captured
2,717

Cited by

Blog
In the post
Date
vivianvoss.net
The Dependency Avalanche Read at the source ↗
25 Apr 2026
woodruffw
We should all be using dependency cooldowns Read at the source ↗
21 Nov 2025
Software Security Engineer — Andrew Lilley Brinker
Open Source Software and Corporate Influence Read at the source ↗
11 Feb 2025
Christian Heilmann
A billion new developers thanks to AI? Read at the source ↗
12 Sept 2024
Christian Heilmann
Eine Milliarde neuer Entwickler dank KI? Linkliste Read at the source ↗
2 Sept 2024
dgregscott.com
The two tales of xz-utils and Crowdstrike. Guest Post by Jan Wildeboer Read at the source ↗
10 Aug 2024
sascha.sh
Monthly links 2024-04 Read at the source ↗
30 Apr 2024
Kaspersky Securelist
Assessing the Y, and How, of the XZ Utils incident Read at the source ↗
24 Apr 2024
share.transistor.fm
Discovering the XZ Backdoor with Andres Freund Read at the source ↗
10 Apr 2024
gendignoux.com
Thoughts on the xz backdoor: an lzma-rs perspective Read at the source ↗
8 Apr 2024
Dmitry Kudryavtsev
xz backdoor Read at the source ↗
4 Apr 2024
swehack.se
The XZ backdoor Read at the source ↗
2 Apr 2024
Nicola Iarocci
Timeline of the XZ open source attack Read at the source ↗
2 Apr 2024
sospedra.me
The maintainer was the exploit Read at the source ↗
2 Apr 2024
chengeric.com
Reflections on the xz backdoor Read at the source ↗
2 Apr 2024
Michael Tsai
xz Backdoor Read at the source ↗
1 Apr 2024
Shellsharks
xz/liblzma Compromise Link Roundup Read at the source ↗
31 Mar 2024
notes: index
XZ Read at the source ↗
31 Mar 2024

Links from this post

Link
Host
https://www.openwall.com/lists/oss-security/2024/03/29/4
openwall.com
https://bsky.app/profile/swtch.com/post/3kp4my7wdom2q
bsky.app
https://hachyderm.io/@rsc/112199506755478946
hachyderm.io
https://github.com/kobolabs/liblzma/blob/87b7682ce4b1c849504e2b3641cebaad62aaef87/doc/history.txt
github.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00512.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00519.html
mail-archive.com
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=6468f7e41a8e9c611e4ba8d34e2175c5dacdbeb4
git.tukaani.org
https://www.mail-archive.com/xz-devel@tukaani.org/msg00553.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00557.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00562.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00563.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00565.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html
mail-archive.com
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=aa75c5563a760aea3aa23d997d519e702e82726b
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=0354d6cce3ff98ea6f927107baf216253f6ce2bb
git.tukaani.org
https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00569.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00570.html
mail-archive.com
https://www.mail-archive.com/xz-devel@tukaani.org/msg00571.html
mail-archive.com
https://infosec.exchange/@briankrebs/112197305365490518
infosec.exchange
https://www.mail-archive.com/xz-devel@tukaani.org/msg00593.html
mail-archive.com
https://github.com/JiaT75?tab=overview&from=2022-10-01&to=2022-10-31
github.com
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=764955e2d4f2a5e8d6d6fec63af694f799e050e7
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=8ace358d65059152d9a1f43f4770170d29d35754
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=799ead162de63b8400733603d3abcd2e1977bdca
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=18b845e69752c975dfeda418ec00eda22605c2ee
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=6ca8046ecbc7a1c81ee08f544bfd1414819fb2e8
git.tukaani.org
https://github.com/google/oss-fuzz/commit/6403e93344476972e908ce17e8244f5c2b957dfd
github.com
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=23b5c36fb71904bfbe16bb20f976da38dadf6c3b
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=b72d21202402a603db6d512fb9271cfa83249639
git.tukaani.org
https://maskray.me/blog/2021-01-18-gnu-indirect-function
maskray.me
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=ee44863ae88e377a5df10db007ba9bfadde3d314
git.tukaani.org
https://github.com/google/oss-fuzz/commit/d2e42b2e489eac6fe6268e381b7db151f4c892c5
github.com
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=c26812c5b2c8a2a47f43214afe6b0b840c73e4f5
git.tukaani.org
https://tukaani.org
tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=2d7d862e3ffa8cec4fd3fdffcd84e984a17aa429
git.tukaani.org
https://bugs.gentoo.org/925415
bugs.gentoo.org
https://tracker.debian.org/news/1506761/accepted-xz-utils-560-01-source-into-unstable/
tracker.debian.org
https://tracker.debian.org/news/1507917/accepted-xz-utils-560-02-source-into-unstable/
tracker.debian.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=a100f9111c8cc7f5b5f0e4a5e8af3de7161c7975
git.tukaani.org
https://docs.kernel.org/userspace-api/landlock.html
docs.kernel.org
https://github.com/systemd/systemd/pull/31550
github.com
https://doublepulsar.com/inside-the-failed-attempt-to-backdoor-ssh-globally-that-got-caught-by-chance-bbfe628fafdd
doublepulsar.com
https://news.ycombinator.com/item?id=39916125
news.ycombinator.com
https://github.com/systemd/systemd/pull/31131
github.com
https://bugzilla.redhat.com/show_bug.cgi?id=2267598
bugzilla.redhat.com
https://github.com/systemd/systemd/commit/3fc72d54132151c131301fc7954e0b44cdd3c860
github.com
https://tracker.debian.org/news/1509743/xz-utils-560-02-migrated-to-testing/
tracker.debian.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=ed957d39426695e948b06de0ed952a2fbbe84bd1
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=4e1c97052b5f14f4d6dda99d12cbbd01e66e3712
git.tukaani.org
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114115
gcc.gnu.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=82ecc538193b380a21622aea02b0ba078e7ade92
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=74b138d2a6529f2c07729d7c77b1725a8e8b16f1
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=fd1b975b7851e081ed6e5cf63df946cd5cbdbb94
git.tukaani.org
https://lkml.org/lkml/2024/3/20/1009
lkml.org
https://lkml.org/lkml/2024/3/20/1008
lkml.org
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708
bugs.debian.org
https://bugs.launchpad.net/ubuntu/+source/xz-utils/+bug/2059417
bugs.launchpad.net
https://tracker.debian.org/news/1515519/accepted-xz-utils-561really545-1-source-into-unstable/
tracker.debian.org
https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad
gitlab.archlinux.org
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
redhat.com
https://fulda.social/@Ganneff/112184975950858403
fulda.social
https://github.com/haikuports/haikuports/commit/3644a3db2a0ad46971aa433c105e2cce9d141b46
github.com
Everything I Know About the XZ Backdoor Read at the source ↗
boehs.org
https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b
bsky.app
https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor
lcamtuf.substack.com
https://lcamtuf.substack.com/p/oss-backdoors-the-allure-of-the-easy
lcamtuf.substack.com
https://connortumbleson.com/2024/03/31/watching-xz-unfold-from-afar/
connortumbleson.com
https://twitter.com/nugxperience/status/1773906926503591970
twitter.com
https://twitter.com/birchb0y/status/1773871381890924872
twitter.com
https://unicornriot.ninja/2024/xz-utils-software-backdoor-uncovered-in-years-long-hacking-plot/
unicornriot.ninja
https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9f504
gist.github.com
https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/
arstechnica.com
https://www.akamai.com/blog/security-research/critical-linux-backdoor-xz-utils-discovered-what-to-know
akamai.com
https://github.com/amlweems/xzbot
github.com
https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and
rheaeve.substack.com
https://www.wired.com/story/jia-tan-xz-backdoor/
wired.com
https://risky.biz/RB743/
risky.biz