Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH004

The xz backdoor, read through Lighthouse's three layers

The answer so far. A compromised release of xz-utils, a compression library that several Linux distributions link into their ssh server through distribution-specific dependencies (see the last finding), carried a backdoor from a tarball built in February 2024 into several distributions' rolling repositories before anyone recognised it (observation, drawn from the sources in Findings). Reading the case through Lighthouse's three layers: the backdoor's residue, malicious code sitting in two release tarballs, was technically public from 24 February 2024, the day version 5.6.0 was released, but nobody detected it there. What was actually detected, twice, sat in the activity layer: memory-checking errors seen in Red Hat's distributions from 4 March, which the backdoor's author answered with a purported fix on 8 March and a reworked backdoor released as 5.6.1 on 9 March, and then, on 29 March, one engineer's own ssh sessions running measurably slower and burning more CPU than they should, alongside valgrind errors on the same machines, which he traced to liblzma and disclosed the same day (observation, S14 and the timeline reconstruction, as read by R-0001). The second of these is the signal that broke the case. The first was not passed over: it was answered, by the person who had planted the backdoor, with changes that took the symptom away (observation of what S14 and the timeline record; the phrase "took the symptom away" is interpretation). Of the two, only the second maps cleanly onto a surface in LH F02's table, Processing, task wall time; the first is a correctness signal from a memory sanitiser, and F02's activity surfaces, tuned to resource consumption, have no row for it (interpretation). Propagation followed only after disclosure gave residue a name: distributions that had already built the compromised tarball reverted their packages within a day, and the case became a CVE, several advisories and a still-cited timeline within the same week (observation, Findings). No instrument Lighthouse has registered or proposed sat at any of these observation points, and the outward instruments LH F02 already names, GH Archive and Open Source Insights, watch source forges and language package ecosystems, not the Linux distribution package pipelines this case actually propagated through (interpretation). Whether an undetected case of the same kind exists today cannot be answered from this one case; it can only say what made this one detectable, which is not the same thing (interpretation, Limits).

Essay, version 0.4, 26 September 2026 studies/LH004/LH004.md

From studies/LH004/ in the repository, last changed 26 September 2026.