"Malicious Code was discovered in the upstream tarballs of XZ ... it interfered with the OpenSSH daemon ... due to systemd linking to liblzma"

https://access.redhat.com/security/cve/CVE-2024-3094