XZ backdoor: “It’s RCE, not auth bypass, and gated/unreplayable.”

Article note: Ever wilder: it now appears the call interception is setting up an RCE for the holder of a specific private key, because login attempts with a specific RSA key would result in the next part of the packet being executed by the sshd process via system(). That's _real_ bad nation-state actor type shit.