thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

nerkat

var isLogin;
  var submitButton;

  document.forms['customer_login'].addEventListener('submit', (event) => {
 
    // show loading gif on submit button
    submitButton = event.target.querySelector('button');
    submitButton.classList.add('spin');
    submitButton.disabled = true;