{"id":55777,"date":"2024-04-05T18:36:57","date_gmt":"2024-04-05T18:36:57","guid":{"rendered":"http:\/\/97732f83-c723-431f-9115-afe7a5c96ab3"},"modified":"2024-04-05T18:36:57","modified_gmt":"2024-04-05T18:36:57","slug":"this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/","title":{"rendered":"This backdoor almost infected Linux everywhere: The XZ Utils close call"},"content":{"rendered":"
\n
\n
\"backdoor-gettyimages-823310866\"<\/picture><\/div>\n

<\/div>

BeeBright\/Getty Images<\/span><\/figcaption><\/figure>\n

It all started when Andres Freund<\/a>, a Microsoft principal software engineer, became curious about why the SSH<\/a> remote security code in the Debian Linux<\/a> beta was running slowly. Freund did some digging and discovered the problem: A chief programmer and maintainer of the xz data compression library, Jia Tan, had put a backdoor in the code<\/a>. Its purpose? To enable attackers to take over Linux systems.<\/p>\n

Also: Linux might be your best bet for heightening your desktop computer security<\/a><\/strong><\/p>\n

Recently, it has become all too common for malicious hackers to insert bad code into software<\/a>. Some open-source code repositories, such as the popular JavaScript<\/a> package manager, Node Package Manager (npm)<\/a>, and the equally popular Python software repository Python Package Index (PyPI)<\/a>, have become infamous for hosting crypto mining and hacking malware.<\/p>\n

There are also open-source malware programs, such as SapphireStealer<\/a>, that seek to steal user IDs, passwords, and other secrets. While there has certainly been a lot of bad code written in Linux and its closely related utilities, no one has ever successfully hidden malware within it –until now.<\/p>\n

<\/p>\n

Before you get too excited, note this: The corrupt xz code did not appear in any production Linux distros. If you were working with Fedora<\/a>, Debian<\/a>, openSUSE<\/a>, Ubuntu<\/a>, or other bleeding-edge beta distributions, you had something to worry about. Otherwise, you should be clear.<\/p>\n

But, make no mistake: Linux dodged a bullet. Had this reached the Linux systems we all use every day — whether or not you’re ever aware of it — we’d be in a world of hurt. <\/p>\n

Ironically, while people are using the xz mess as an excuse to whip open source, the truth is that the attack failed because<\/em> of open source. As Mark Atwood, Amazon’s open source program office principal engineer, noted, “The attack failed because it was open source<\/a>. The way this attack works for non-open source is the attacker spends two years getting an agent hired by a contract software development vendor, they sneak it in, [and] nobody finds out.”<\/p>\n

Also: Thinking about switching to Linux? 10 things you need to know<\/a><\/strong><\/p>\n

How can he say that? Because it’s the truth. For example, we still don’t know exactly how Microsoft allowed a Chinese hacking group to break into Microsoft Online Exchange<\/a> last year. Thanks to Freund, we know a great deal about how the xz hack was accomplished. As Dimitri Stiliadis, Endor Labs<\/a> CTO and co-founder, pointed out, “We were lucky that the attack happened against open-source software<\/a> that anyone can look at and understand. If the same attack was against a closed source component, how would we even know?”<\/p>\n

Amen. <\/p>\n

What we don’t know yet is who was behind the attack — or why. There’s much speculation<\/a> that it was another Chinese hacking group; but at the end of the day, we’re left with educated guesses. <\/p>\n

For example, instead of international politics being behind the malware, it could have been an especially elaborate attempt to plant crypto miners into high-powered Linux systems. With current Bitcoin values hovering around $65,000 a coin, greed is a plausible motive.  <\/p>\n

We do<\/em> know that whoever was behind the name Jia Tan took a lot of time and trouble planting the malware. Tan began his dark work in 2021<\/a>. He or she, with the aid of some sock puppets<\/a>, gradually took control of the xz project. Tan and his colleagues then started pushing for the new backdoor-infected program to be fast-tracked into Linux distros.<\/p>\n

It’s at this point that Freund’s digging into the code uncovered the plot. Today, Lasse Collin, the original XZ maintainer<\/a>, has taken back control of the project and is cleaning the code.  <\/p>\n

Also: The best Linux distros for beginners: Expert tested<\/a><\/strong><\/p>\n

There’s also been speculation that Tan and company had already placed malware in earlier xz versions. There doesn’t appear to be anything to this. <\/p>\n

Others are worried that xz was just the tip of the iceberg and that there are many other open-source malware programs hiding in Linux. But, as Eric S. Raymond, open-source co-founder, observed<\/a>, “It sounds prudent and cautious to suppose that for any discovered exploit, there must be a large number of undiscovered ones. But we don’t actually know that, and even if it were true, it wouldn’t lead to actionable advice.”<\/p>\n

So, what can we do about it? Lots!<\/p>\n

Before this trap-door-equipped malware was discovered, the Open Source Security Foundation (OpenSSF<\/a>) had proposed that we adopt policies for secure and responsible open-source software use<\/a>. <\/p>\n

In the aftermath, Dan Lorenc, co-founder and CEO of open-source software supply chain company Chainguard<\/a>, proposed that we reflect on the gaps this attack has surfaced and build up more in-depth defense across the entire open-source supply chain<\/a>:  “Persistent threats aren’t going away, and we can’t magically stop them, but we can continue to raise the bar and make them harder.”<\/p>\n

Also: 5 tips for securing SSH on your Linux server or desktop<\/a><\/strong><\/p>\n

Lorenc’s right. As he also stated, “We got incredibly lucky.”  <\/p>\n

Open source, by its very nature, is potentially more secure than proprietary methods. But, it’s only more secure if we take a long, hard look at the code we use and make sure it really is safe. The idea that the code is safe just because it’s open is magical thinking at its worst. Wishing won’t make open-source or Linux secure; only hard work will do that.<\/p>\n

\n
\n

Open Source<\/h4>\n

<\/span> <\/div>\n<\/div>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

For the first time, an open-source maintainer put malware into a key Linux utility. We’re still not sure who or why – but here’s what you can do about it.
\nREAD MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-55777","post","type-post","status-publish","format-standard","hentry","category-zdnet-security"],"yoast_head":"\nThis backdoor almost infected Linux everywhere: The XZ Utils close call 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"This backdoor almost infected Linux everywhere: The XZ Utils close call 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-04-05T18:36:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\/2024\/04\/05\/0b16c315-a466-4d2c-9c1f-692593beaa62\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"This backdoor almost infected Linux everywhere: The XZ Utils close call\",\"datePublished\":\"2024-04-05T18:36:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/\"},\"wordCount\":941,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\\\/2024\\\/04\\\/05\\\/0b16c315-a466-4d2c-9c1f-692593beaa62\\\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/\",\"name\":\"This backdoor almost infected Linux everywhere: The XZ Utils close call 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\\\/2024\\\/04\\\/05\\\/0b16c315-a466-4d2c-9c1f-692593beaa62\\\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280\",\"datePublished\":\"2024-04-05T18:36:57+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\\\/2024\\\/04\\\/05\\\/0b16c315-a466-4d2c-9c1f-692593beaa62\\\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\\\/2024\\\/04\\\/05\\\/0b16c315-a466-4d2c-9c1f-692593beaa62\\\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"This backdoor almost infected Linux everywhere: The XZ Utils close call\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"This backdoor almost infected Linux everywhere: The XZ Utils close call 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/","og_locale":"en_US","og_type":"article","og_title":"This backdoor almost infected Linux everywhere: The XZ Utils close call 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-04-05T18:36:57+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\/2024\/04\/05\/0b16c315-a466-4d2c-9c1f-692593beaa62\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"This backdoor almost infected Linux everywhere: The XZ Utils close call","datePublished":"2024-04-05T18:36:57+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/"},"wordCount":941,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\/2024\/04\/05\/0b16c315-a466-4d2c-9c1f-692593beaa62\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/","url":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/","name":"This backdoor almost infected Linux everywhere: The XZ Utils close call 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\/2024\/04\/05\/0b16c315-a466-4d2c-9c1f-692593beaa62\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280","datePublished":"2024-04-05T18:36:57+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\/2024\/04\/05\/0b16c315-a466-4d2c-9c1f-692593beaa62\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/c29d5287b44d0bdf197dbd3b8bf52b526ed5b848\/2024\/04\/05\/0b16c315-a466-4d2c-9c1f-692593beaa62\/backdoor-gettyimages-823310866.jpg?auto=webp&width=1280"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/this-backdoor-almost-infected-linux-everywhere-the-xz-utils-close-call\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"This backdoor almost infected Linux everywhere: The XZ Utils close call"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=55777"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55777\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=55777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=55777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=55777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}