PERSISTENT RISK: XZ UTILS BACKDOOR STILL LURKING IN DOCKER IMAGES

Summary from the TLDR InfoSec newsletter

Binarly warns that the XZ Utils backdoor (CVE-2024-3094) still lurks in Debian-based Docker Hub images from March 11, 2024, propagating into derivative images. It found 35+ affected tags, and the risk persists via inherited bases and CI pipelines. Recommendations: avoid those tags, rebuild from patched bases, and scan for the issue in your images.