On this podcast, Jay and Joao have discussed multiple times a situation where a threat actor submits a pull request that's more than the project bargained for. And now, we have a situation where OpenSSH was (almost) backdoored by a commit by a maintainer of the xz project. Don't miss this episode for all the details! Thanks to TuxCare for sponsoring the Enterprise Linux Security podcast. Check out their awesome services to see how they can simplify Linux administration! ➜ https://learnlinux.link/tuxcare Relevant Links • A Deep Dive on the xz Compromise (Joao's Article) ➜ https://tuxcare.com/blog/a-deep-dive-on-the-xz-compromise/ • XZ Utils Supply Chain Attack: A Threat Actor Spent Two Years to Implement a Linux Backdoor ➜ https://www.techrepublic.com/article/xz-backdoor-linux/ Check out the LLTV Shop! Shirts, bags, cups and much more! ➜ https://merch.learnlinux.tv/ Support the Channel Show your support for Learn Linux TV and get access to exclusive perks! • Become a Channel Member ➜ https://learnlinux.link/member • Become a Patron ➜ https://learnlinux.link/patron Official Stores and Merchandise • Linux Merch ➜ https://merch.learnlinux.tv/ • Latest book: Mastering Ubuntu Server ➜ https://ubuntuserverbook.com/ • Linux stuff from Amazon ➜ https://learnlinux.link/amazon • Awesome Pi-powered KVM ➜ https://learnlinux.link/tinypilot • 5% discount on LPI exam vouchers ➜ https://learnlinux.link/lpi-voucher Note: Royalties and/or commission is earned from some of the above links Relevant Articles • Why software 'security debt' is becoming a serious problem for developers ➜ https://learnlinux.link/security-debt-article Full Courses from Learn Linux TV • Linux Crash Course series ➜ https://linux.video/cc • Learn how to use tmux ➜ https://linux.video/tmux • Learn how to use vim ➜ https://linux.video/vim • Bash Scripting Series ➜ https://linux.video/bash • Proxmox VE Cluster Full Course ➜ https://linux.video/pve • Learn Ansible ➜ https://linux.video/ansible Boost your Linux skills with these stand-alone tutorials • Essential tweaks for ALL Linux Servers ➜ https://linux.video/all-servers • Install Arch Linux ➜ https://linux.video/arch-guide • Use Ventoy to create a multi-distro flash drive ➜ https://linux.video/ventoy • Browse the web from within your Linux terminal ➜ https://linux.video/term-web • From Zero to Proxmox ➜ https://linux.video/zero-to-pve • Check out Neovim ➜ https://linux.video/neovim • Systemd Deep Dive ➜ https://linux.video/systemd • Systemd Timers ➜ https://www.youtube.com/watch?v=n6BuUgkZ5T0 • Installing an operating system for Raspberry Pi ➜ https://linux.video/pi-imager • Connecting to a Linux server via ssh ➜ https://linux.video/ssh • Linux permissions ➜ https://linux.video/perms • OpenSSH Guide ➜ https://linux.video/ssh-guide • 10 Linux Terminal Tips and Tricks ➜ https://linux.video/cli-tricks-1 • Over 15 Terminal Tricks ➜ https://linux.video/cli-tricks-2 Learn Linux TV on the Web • Main site ➜ https://www.learnlinux.tv/ • Community ➜ https://community.learnlinux.tv/ • Enterprise Linux Security Podcast ➜ https://enterpriselinuxsecurity.show/ • The Homelab Show Podcast ➜ https://thehomelab.show/ • Content Ethics ➜ https://www.learnlinux.tv/content-ethics • Request Assistance ➜ https://www.learnlinux.tv/request-assistance Disclaimer Learn Linux TV provides technical content that will hopefully be helpful to you and teach you something new. However, this content is provided without any warranty (expressed or implied). Learn Linux TV is not responsible for any damages that may arise from any use of this content. The person viewing Learn Linux TV's content is expected to follow their best judgement and to make their best decisions while working with any related technology. Always make sure you have written permission before working with any infrastructure. Also, be sure that you're compliant with all company rules, change control procedures, and local laws. #linuxsecurity #xz #Linux