In the latest liblzma update, a trusted bad actor called 'JiaT75' implemented a backdoor which allows RCA calls to system() on ssh connections. Here I'm look...
However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist.
Arch put out a statement saying users should update to a non infected binary even though it doesn’t appear to affect Arch https://archlinux.org/news/the-xz-package-has-been-backdoored/