EVERYTHING I KNOW ABOUT THE XZ BACKDOOR

Summary from the TLDR Web Dev newsletter

A sophisticated security attack compromised the xz compression library, a critical dependency of OpenSSH. The backdoor, introduced by a seemingly helpful new maintainer, allowed attackers to gain unauthorized access to affected servers. The backdoor was discovered by Andres Freund, a software engineer at Microsoft, when he found that SSH logins were using a lot of CPU power compared to normal.