Until the last days of March 2024, almost nobody outside a small circle of programmers had heard of liblzma. It was a compression library, a piece of plumbing buried deep in Linux, and for two years someone had been preparing to use it to walk through the front door of the internet.
He called himself Jia Tan. He was patient. He wrote helpful patches. He was polite to an exhausted volunteer maintainer, and useful, and always there, and in time he was given the keys. Then he began to build. The payload went into the release tarballs in pieces, obfuscated and disguised as test files. It was aimed at OpenSSH, the program that guards remote access to nearly every server on Earth. Once the code shipped in the stable releases of the major Linux distributions, whoever held the private key could let himself into a large share of the world's machines.
