: Jia Tan merged several patches into the XZ, proving that Jun 2023 : An account named “Hans Jansen” submitted a patch that employed glibc’s indirect function ( IFUNC ) mechanism to select the CRC function, laying the groundwork for the subsequent backdoor. Attackers quickly released xz-5.6.1 with two “bugfix” patches: the first being a disguised patch claiming to fix the bug, and the second a binary patch that actually fixed the bug in the backdoor. Mar 28, 2024: Several accounts led by Jia Tan complained on the Debian/Ubuntu bug list, pushing for the upgrade of the xz package in Debian to the backdoored xz-5.6.1 .