Five hundred milliseconds. That was the gap between routine and catastrophe.
On a Friday morning in late March 2024, Andres Freund was running benchmarks on his development machine in San Francisco. He was a 38-year-old software engineer at Microsoft, originally from Germany, and his regular work involved PostgreSQL, an open-source database.
He was not a security researcher. He was not looking for security issues.
But SSH logins on his Debian test system were taking half a second longer than they should have. Failed login attempts from automated bots were burning more CPU than normal.
Most engineers would have closed the laptop. Freund did not.
He traced the slowdown to a recently updated version of XZ Utils, a small compression library buried deep in the Linux operating system. XZ Utils does one thing: it squeezes data to make files smaller.
For years it had been maintained by a single volunteer in Finland, working without pay.
What Freund found inside was not a bug. It was a backdoor, planted with patience over the course of three years.
A person using the name Jia Tan had appeared on GitHub in January 2021 and spent two years submitting clean, useful code. Other mailing list accounts, likely sock puppets, pressured the original maintainer to cede control.
This gold plate could power the next phase of AI.
This golden AI processor is the size of a dinner plate. And it can run up to 1,000 times faster than standard AI systems.
OpenAI, Amazon and IBM have already made deals with the little-known company that makes it. According to tech investor Jeff Brown, a former senior exec at Qualcomm and NXP, it’s about to become one of the most important names in AI.
Watch this free briefing video today to learn more about what it is, and why it could be the key to growing your nest egg.
The maintainer, exhausted and working alone, relented. Jia Tan was given release authority and slipped the malicious code in during February 2024.
The backdoor targeted OpenSSH, the implementation of the SSH protocol used to remotely manage servers. Anyone holding a specific cryptographic key could bypass authentication entirely and execute commands on an affected machine.
The vulnerability received a severity score of 10.0 out of 10, the maximum possible.
Linux runs over 96 percent of the world's top web servers. It underpins the cloud platforms behind banking, hospitals, defense networks, and stock exchanges.
The compromised code had already entered testing channels for major Linux distributions. It was weeks from reaching production systems worldwide.
On March 29, 2024, Freund posted his findings to an open-source security mailing list. Red Hat issued an emergency alert the same day.
The U.S. Cybersecurity and Infrastructure Security Agency published an advisory. Ubuntu delayed the beta of its next major release by a week and rebuilt all binary packages built after the compromised code was committed.
The attack was stopped before the door opened. No one was pulled from a fire. No one was resuscitated on a roadside.
Had it gone unnoticed, the backdoor would have given a suspected state actor access to hundreds of millions of servers worldwide. Banking systems, medical records, power grids, defense infrastructure.
Microsoft's CEO publicly praised Freund's curiosity. The security community credited him with preventing what could have been the most damaging supply chain attack in computing history.
Then the news moved on.
When something at your post feels half a second off, do you pull the thread or let it go?
