XZ Utils Backdoor: How a Microsoft Dev Accidentally Stopped a Global Linux Threat

In late March 2024, Microsoft engineer Andres Freund discovered a sophisticated backdoor in xz Utils, a widely used compression library present on most Linux and macOS systems, while investigating unusual SSH login slowdowns on a test machine. The vulnerability, tracked as CVE-2024-3094, was not a coding accident but the result of a multi-year social engineering campaign by a threat actor using the alias 'Jia Tan', who gradually earned commit access to the xz Utils project. The malicious code was concealed inside obfuscated binary test files and activated only under specific build conditions, ultimately targeting the SSH daemon to allow unauthorized root access without leaving log traces. Had the backdoor gone undetected, it could have compromised millions of servers worldwide once it reached stable releases of major Linux distributions such as Debian and Red Hat. The incident has been widely described as a wake-up call for open-source security, raising urgent questions about supply chain integrity, maintainer burnout, and trust in critical software infrastructure.