XZ Utils backdoor (English Wikipedia)

Tumbleson, Connor (31 March 2024). "Watching xz unfold from afar". connortumbleson.com. Archived from the original on 6 April 2024. Retrieved 14 August 2025.

debian.org (Global: 3,857^th place; English: 2,958^th place)

lists.debian.org

Salvatore, Bonaccorso (29 March 2024). "[SECURITY] [DSA 5649-1] xz-utils security update". debian-security-announce (Mailing list). Archived from the original on 29 March 2024. Retrieved 29 March 2024.

duo.com (Global: low place; English: low place)

O'Donnell-Welch, Lindsey (29 March 2024). "Red Hat, CISA Warn of XZ Utils Backdoor". Decipher. Archived from the original on 29 March 2024. Retrieved 29 March 2024.

gigazine.net (Global: 3,474^th place; English: low place)

"Timeline summary of the backdoor attack on XZ Utils". gigazine.net. 3 April 2024. Archived from the original on 10 April 2024. Retrieved 14 August 2025.

github.com (Global: 383^rd place; English: 320^th place)

github.com

Collin, Lasse. "Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094)". GitHub. Retrieved 19 June 2024.
Haruyama, Takahiro (6 August 2025). "Docker Hub Debian image contains CVE-2024-3094 backdoor". github.com. Retrieved 14 August 2025.

gist.github.com

James, Sam. "xz-utils backdoor situation (CVE-2024-3094)". GitHub. Archived from the original on 2 April 2024. Retrieved 2 April 2024.

gitlab.com (Global: low place; English: 9,569^th place)

about.gitlab.com

Choudhary, Shrishti (30 March 2024). "Important information regarding xz-utils (CVE-2024-3094)". about.gitlab.com. Archived from the original on 1 April 2024. Retrieved 14 August 2025.

helpnetsecurity.com (Global: low place; English: low place)

Zorz, Zeljka (29 March 2024). "Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)". Help Net Security. Archived from the original on 29 March 2024. Retrieved 29 March 2024.

itsfoss.com (Global: low place; English: low place)

news.itsfoss.com

Rudra, Sourav (14 August 2025). "Security Researchers Find XZ Utils Backdoored Debian Images on Docker Hub". news.itsfoss.com. Retrieved 14 August 2025.

lwn.net (Global: 4,423^rd place; English: 2,925^th place)

Corbet, Jonathan. "A backdoor in xz". LWN. Archived from the original on 1 April 2024. Retrieved 2 April 2024.

nist.gov (Global: 355^th place; English: 454^th place)

nvd.nist.gov

"CVE-2024-3094". National Vulnerability Database. NIST. Archived from the original on 2 April 2024. Retrieved 2 April 2024.

nytimes.com (Global: 7^th place; English: 7^th place)

Roose, Kevin (3 April 2024). "Did One Guy Just Stop a Huge Cyberattack?". The New York Times. Archived from the original on 4 April 2024. Retrieved 4 April 2024.

omgubuntu.co.uk (Global: low place; English: low place)

Sneddon, Joey (3 April 2024). "Ubuntu 24.04 Beta Delayed Due to Security Issue". OMG! Ubuntu. Archived from the original on 8 April 2024. Retrieved 10 April 2024.

openwall.com (Global: low place; English: low place)

Freund, Andres (29 March 2024). "oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise". www.openwall.com. Archived from the original on 1 April 2024. Retrieved 14 August 2025.

redhat.com (Global: 5,386^th place; English: 4,042^nd place)

Freire, Rodrigo (30 April 2024). "Understanding Red Hat's response to the XZ security incident". redhat.com. Retrieved 14 August 2025.
"Urgent security alert for Fedora 41 and Fedora Rawhide users". Red Hat. 29 March 2024. Archived from the original on 29 March 2024. Retrieved 14 August 2025.

suse.com (Global: low place; English: low place)

Meissner, Marcus (27 December 2024). "SUSE addresses supply chain attack against xz compression library". SUSE Communities. SUSE. Archived from the original on 29 March 2024. Retrieved 14 August 2025.

swtch.com (Global: low place; English: low place)

research.swtch.com

Cox, Russ (1 April 2024). "Timeline of the xz open source attack". research.swtch.com. Retrieved 14 August 2025.

theregister.com (Global: 3,700^th place; English: 2,360^th place)

Claburn, Thomas (29 March 2024). "Malicious backdoor spotted in Linux compression library xz". The Register. Archived from the original on 1 April 2024. Retrieved 14 August 2025.
Claburn, Thomas. "Malicious xz backdoor reveals fragility of open source". The Register. Archived from the original on 8 April 2024. Retrieved 8 April 2024.

theverge.com (Global: 114^th place; English: 90^th place)

Khalid, Amrita (2 April 2024). "How one volunteer stopped a backdoor from exposing Linux systems worldwide". The Verge. Archived from the original on 4 April 2024. Retrieved 4 April 2024.

ubuntu.com (Global: 4,803^rd place; English: 3,931^st place)

discourse.ubuntu.com

"Noble Numbat Beta delayed (xz/liblzma security update)". Ubuntu Community Hub. 3 April 2024. Archived from the original on 10 April 2024. Retrieved 10 April 2024.

web.archive.org (Global: 1^st place; English: 1^st place)

James, Sam. "xz-utils backdoor situation (CVE-2024-3094)". GitHub. Archived from the original on 2 April 2024. Retrieved 2 April 2024.
Gatlan, Sergiu. "Red Hat warns of backdoor in XZ tools used by most Linux distros". BleepingComputer. Archived from the original on 29 March 2024. Retrieved 29 March 2024.
"CVE-2024-3094". National Vulnerability Database. NIST. Archived from the original on 2 April 2024. Retrieved 2 April 2024.
Corbet, Jonathan. "A backdoor in xz". LWN. Archived from the original on 1 April 2024. Retrieved 2 April 2024.
Zorz, Zeljka (29 March 2024). "Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)". Help Net Security. Archived from the original on 29 March 2024. Retrieved 29 March 2024.
Freund, Andres (29 March 2024). "oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise". www.openwall.com. Archived from the original on 1 April 2024. Retrieved 14 August 2025.
Goodin, Dan (1 April 2024). "What we know about the xz Utils backdoor that almost infected the world". Ars Technica. Archived from the original on 1 April 2024. Retrieved 1 April 2024.
O'Donnell-Welch, Lindsey (29 March 2024). "Red Hat, CISA Warn of XZ Utils Backdoor". Decipher. Archived from the original on 29 March 2024. Retrieved 29 March 2024.
Claburn, Thomas (29 March 2024). "Malicious backdoor spotted in Linux compression library xz". The Register. Archived from the original on 1 April 2024. Retrieved 14 August 2025.
"Urgent security alert for Fedora 41 and Fedora Rawhide users". Red Hat. 29 March 2024. Archived from the original on 29 March 2024. Retrieved 14 August 2025.
Greenberg, Andy (3 April 2024). "The Mystery of 'Jia Tan,' the XZ Backdoor Mastermind". Wired. Archived from the original on 3 April 2024. Retrieved 3 April 2024.
Tumbleson, Connor (31 March 2024). "Watching xz unfold from afar". connortumbleson.com. Archived from the original on 6 April 2024. Retrieved 14 August 2025.
"Timeline summary of the backdoor attack on XZ Utils". gigazine.net. 3 April 2024. Archived from the original on 10 April 2024. Retrieved 14 August 2025.
Claburn, Thomas. "Malicious xz backdoor reveals fragility of open source". The Register. Archived from the original on 8 April 2024. Retrieved 8 April 2024.
"Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094". CISA. 29 March 2024. Archived from the original on 29 March 2024. Retrieved 29 March 2024.
Meissner, Marcus (27 December 2024). "SUSE addresses supply chain attack against xz compression library". SUSE Communities. SUSE. Archived from the original on 29 March 2024. Retrieved 14 August 2025.
Salvatore, Bonaccorso (29 March 2024). "[SECURITY] [DSA 5649-1] xz-utils security update". debian-security-announce (Mailing list). Archived from the original on 29 March 2024. Retrieved 29 March 2024.
Choudhary, Shrishti (30 March 2024). "Important information regarding xz-utils (CVE-2024-3094)". about.gitlab.com. Archived from the original on 1 April 2024. Retrieved 14 August 2025.
"Noble Numbat Beta delayed (xz/liblzma security update)". Ubuntu Community Hub. 3 April 2024. Archived from the original on 10 April 2024. Retrieved 10 April 2024.
Sneddon, Joey (3 April 2024). "Ubuntu 24.04 Beta Delayed Due to Security Issue". OMG! Ubuntu. Archived from the original on 8 April 2024. Retrieved 10 April 2024.
Roose, Kevin (3 April 2024). "Did One Guy Just Stop a Huge Cyberattack?". The New York Times. Archived from the original on 4 April 2024. Retrieved 4 April 2024.
Khalid, Amrita (2 April 2024). "How one volunteer stopped a backdoor from exposing Linux systems worldwide". The Verge. Archived from the original on 4 April 2024. Retrieved 4 April 2024.

wired.com (Global: 193^rd place; English: 152^nd place)

Greenberg, Andy (3 April 2024). "The Mystery of 'Jia Tan,' the XZ Backdoor Mastermind". Wired. Archived from the original on 3 April 2024. Retrieved 3 April 2024.

youtube.com (Global: 9^th place; English: 13^th place)

"Oxide and Friends 4/8/2024 -- Discovering the XZ Backdoor with Andres Freund" (video). youtube.com. Oxide Computer Company. 14 August 2025.

XZ Utils backdoor (English Wikipedia)

arstechnica.com (Global: 388th place; English: 265th place)

binarly.io (Global: low place; English: low place)

bleepingcomputer.com (Global: 6,171st place; English: 4,055th place)

cisa.gov (Global: low place; English: low place)

connortumbleson.com (Global: low place; English: low place)

debian.org (Global: 3,857th place; English: 2,958th place)

lists.debian.org

duo.com (Global: low place; English: low place)

gigazine.net (Global: 3,474th place; English: low place)

github.com (Global: 383rd place; English: 320th place)

github.com

gist.github.com

gitlab.com (Global: low place; English: 9,569th place)

about.gitlab.com

helpnetsecurity.com (Global: low place; English: low place)

itsfoss.com (Global: low place; English: low place)

news.itsfoss.com

lwn.net (Global: 4,423rd place; English: 2,925th place)

nist.gov (Global: 355th place; English: 454th place)

nvd.nist.gov

nytimes.com (Global: 7th place; English: 7th place)

omgubuntu.co.uk (Global: low place; English: low place)

openwall.com (Global: low place; English: low place)

redhat.com (Global: 5,386th place; English: 4,042nd place)

suse.com (Global: low place; English: low place)

swtch.com (Global: low place; English: low place)

research.swtch.com

theregister.com (Global: 3,700th place; English: 2,360th place)

theverge.com (Global: 114th place; English: 90th place)

ubuntu.com (Global: 4,803rd place; English: 3,931st place)

discourse.ubuntu.com

web.archive.org (Global: 1st place; English: 1st place)

wired.com (Global: 193rd place; English: 152nd place)

youtube.com (Global: 9th place; English: 13th place)

arstechnica.com (Global: 388^th place; English: 265^th place)

bleepingcomputer.com (Global: 6,171^st place; English: 4,055^th place)

debian.org (Global: 3,857^th place; English: 2,958^th place)

gigazine.net (Global: 3,474^th place; English: low place)

github.com (Global: 383^rd place; English: 320^th place)

gitlab.com (Global: low place; English: 9,569^th place)

lwn.net (Global: 4,423^rd place; English: 2,925^th place)

nist.gov (Global: 355^th place; English: 454^th place)

nytimes.com (Global: 7^th place; English: 7^th place)

redhat.com (Global: 5,386^th place; English: 4,042^nd place)

theregister.com (Global: 3,700^th place; English: 2,360^th place)

theverge.com (Global: 114^th place; English: 90^th place)

ubuntu.com (Global: 4,803^rd place; English: 3,931^st place)

web.archive.org (Global: 1^st place; English: 1^st place)

wired.com (Global: 193^rd place; English: 152^nd place)

youtube.com (Global: 9^th place; English: 13^th place)