Backdoor in upstream xz/liblzma leading to SSH server compromise

Ah, should have guessed this was already being discussed: https://news.ycombinator.com/item?id=39865810