The xz package tar's were backdoored. Only discovered because the backdoor slowed down sshd enough for Andres Freund to investigate. Consider the case where the backdoor didn't cause perf issues... How long would this have gone undetected? openwall.com/lists/oss-secu…

Hacklu CTF is still running for ~23h! We still have some unsolved challenges, including: - 📱Android Flutter exploitation - 🦊 2 webs with Firefox bots - 🐒 pwning a 17 year old SpiderMonkey - ✍️ LaTeX madness Come play: flu.xxx