---
id: 1769
title: "XZ Utils CVE-2024-3094: A Tale of Broken Trust, Curious Persistence, and a Call to Action"
cve: CVE-2024-3094
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/xz-utils-cve-2024-3094-tale-broken-trust-curious-persistence-and-call-action"
published_at: "2024-04-01T16:00:12Z"
tags: ["supply-chain", "open-source", "linux", "backdoor", "xz-utils", "cve-2024-3094"]
phying_url: "https://phying.com/item/1769"
lang: en
---

# XZ Utils CVE-2024-3094: A Tale of Broken Trust, Curious Persistence, and a Call to Action

## Summary

A backdoor in XZ Utils 5.6.0 and 5.6.1 (CVE-2024-3094) surfaced when Andres Freund noticed sshd slowdowns; the code hid in compressed test files after a long-grooming supply chain effort.

## Intelligence Metadata

- **Sources:** hackerone.com
- **CVE:** CVE-2024-3094
- **Published:** 2024-04-01T16:00:12Z
- **Original:** https://www.hackerone.com/blog/xz-utils-cve-2024-3094-tale-broken-trust-curious-persistence-and-call-action
- **Phying News:** https://phying.com/item/1769