XZ Backdoor

In this blog, we share a new finding in the XZ Utils saga: several Docker images built around the time of the compromise contain the backdoor. At first glance, this might not seem alarming: if the distribution packages were backdoored, then any Docker images based on them would be infected as well. However, what we discovered is that some of these compromised images are still publicly available on Docker Hub.

Wired's comprehensive coverage of the XZ Utils backdoor.

SC Media reports on Binarly's online XZ backdoor scanning tool.

Bleeping Computer covers Binarly's XZ backdoor scanner.

Business Wire announces Binarly's release of a free detection tool for the XZ Utils backdoor.

Binarly, provider of an industry leading AI-powered firmware and software supply chain security platform, has created and released a free scanning tool to help defenders spot signs of the dangerous XZ backdoor (CVE-2024-3094).

On March 29, right before Easter weekend, we received notifications about something unusual happening with the open-source project XZ Utils, which provides lossless data compression on virtually all Unix-like operating systems, including Linux.

Upload a binary and see if you're impacted by XZ Utils.