The story developing around this xz / ssh #CVE-2024-3094 is absolutely wild. This has ‘state actor’ written all over it.

https://boehs.org/node/everything-i-know-about-the-xz-backdoor