The ifunc part looked more legitimate, it was used to switch between optimized implementations of CRC. So that part was in the git repo. https://github.com/google/oss-fuzz/pull/10667
In The xz attack shell scriptgoogle
oss-fuzz
Shell2016–2024
google / oss-fuzz
oss-fuzz
OSS-Fuzz - continuous fuzzing for open source software.
53Distinct people
54Mentions
0Explicit recommenders
13KGitHub stars
What to know before exploring
What it is
OSS-Fuzz - continuous fuzzing for open source software.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year54 dated mentions
Observed mentions: 2016-10-13 22:31:04 UTC to 2024-04-02 22:50:18 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 5 | 4 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 4 | 2 | 2 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 21 | 1 | 20 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
OSS-Fuzz: Continuous Fuzzing for Open Source Software
Fuzz testing is a well-known technique for uncovering programming errors in
software. Many of these detectable errors, like buffer overflow, can have
serious security implications. Google has found thousands of security
vulnerabilities and stability bugs by deploying guided in-process fuzzing of
Chrome components, and we now want to share that service with the open source
community.
In cooperation with the Core Infrastructure Initiative and the OpenSSF,
OSS-Fuzz aims to make common open source software more secure and stable by
combining modern fuzzing techniques with scalable, distributed execution.
Projects that do not qualify for OSS-Fuzz (e.g. closed source) can run their own
instances of ClusterFuzz or ClusterFuzzLite.
We support the libFuzzer, AFL++, and Honggfuzz fuzzing engines in
combination with Sanitizers, as well as ClusterFuzz, a distributed fuzzer
execution environment and reporting tool.
Currently, OSS-Fuzz supports C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua code. Other languages
supported by LLVM may work too. OSS-Fuzz supports fuzzing x86_64 and i386
builds.
Overview
Documentation
Read our detailed documentation to learn how to use OSS-Fuzz.
Trophies
As of May 2025, OSS-Fuzz has helped identify and fix over 13,000 vulnerabilities and 50,000 bugs across 1,000 projects.
Blog posts
2024-11-20 - Leveling Up Fuzzing: Finding more vulnerabilities with AI
2023-08-16 - AI-Powered Fuzzing: Breaking the Bug Hunting Barrier
2023-02-01 - Taking the next step: OSS-Fuzz in 2023
2022-09-08 - Fuzzing beyond memory corruption: Finding broader classes of vulnerabilities automatically
2021-12-16 - Improving OSS-Fuzz and Jazzer to catch Log4Shell
2021-03-10 - Fuzzing Java in OSS-Fuzz
2020-12-07 - Improving open source security during the Google summer internship program
2020-10-09 - Fuzzing internships for Open Source Software
2018-11-06 - A New Chapter for OSS-Fuzz
2017-05-08 - OSS-Fuzz: Five months later, and rewarding projects
2016-12-01 - Announcing OSS-Fuzz: Continuous fuzzing for open source software
Read the full README on GitHubWhat Hacker News says
54 sourcesThe attacker changed the projects contact details at oss fuzz (an automated detection tool). There’s an interesting discussion as to whether that would have picked up the vulnerability https://github.com/google/oss-fuzz/issues/11760
In Xzbot: Notes, honeypot, and exploit demo for the xz backdoorThe interest in OSS-Fuzz was because it was used to monitor libxz, and so one of the necessary subgoals was to trick its maintainers into exempting libxz from a check that may have caught the backdoor, or at least drawn attention to it for unrelated reasons: https://github.com/google/oss-fuzz/pull/10667
In What we know about the xz Utils backdoor that almost infected the worldHello everybody.
I am taking the initiative to gather more information regarding the possible precursors and perpetrators of the backdoor.
The purpose of this commentary is focused on open source information (OSINT).
I am not a judge of anyone or any action that may occur, the objective of this comment is to help through accurate and quick information to help the core developers of the affected packages and consequently the Linux kernel (which may have been indirectly or directly affected) take action necessary in relation to the fact that occurred.
NOTE: This comment will always have "edit" so always review it for information.
Information I have so far.
Summary:
1. GitHub Account Suspension:
- The accounts of @JiaT75 and @Larhzu were suspended by GitHub.
- All Tukaani repositories, including downloads, were disabled.
- Investiga
Read the rest
te the cause of the account suspensions and whether there is any correlation with suspicious activities.
2. Possible Backdoor in xz/liblzma:
- There are concerns about the presence of a backdoor in xz/liblzma.
- Investigate whether there is evidence of compromise in the source code and recent updates.
- Examine potential impacts, especially if the software is used in critical systems.
3. Updates and Patches in Packages:
- Note recent updates in packages such as MinGW w64, pacman-static, Alpine, and OpenSUSE.
- Review changelogs to understand if these updates are related to security fixes.
4. Jia's Activities on Platforms and Projects:
- Investigate Jia's contributions to different projects and platforms, such as Arch Linux, Alpine Linux, and OpenSUSE.
- Check for correlations between Jia's activities and reported security issues.
5. Libera Registration Information:
- Analyze Jia's registration details on Libera to determine the timeline of their online activities.
- Consider correlating this information with other online activities of Jia.
6. VPN Usage:
- Confirm Jia's use of VPN and assess its impact on security investigations.
- Explore possible reasons for using a VPN and how it may affect the identification and tracking of online activities.
Links related to user JiaT75
[xz] Remove JiaT75 as a contact, determine correct contacts #11760 - Google/oss-fuzz
https://github.com/google/oss-fuzz/issues/11760
Tuktest index hash #7 - tukaani-project/xz/pull/7
https://web.archive.org/web/20240329230522/https://github.co...
Did the artefact produced [0] for fussing even include the backdoored .so? My understanding was that the compromised build-scripts had measures to only run when producing deb/rpms.
https://github.com/google/oss-fuzz/blob/5f70676a6c9050b9cb68...
In XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."One of the takeaways from this to me is that there is way too much sketchy bullshit happening in critical system software. Prebuilt binary blobs [1]? Rewriting calls to SIMD enhanced versions at runtime [2]? Disabling sanitizers [3]? Incomprehensible build scripts [4]?
All of this was either at least strongly frowned upon, if not outright unacceptable, on every project I've ever worked on, either professionally or for fun. And the stakes were far lower for those projects than critical linux system software.
1. https://lwn.net/Articles/967442/
2, 3: https://github.com/google/oss-fuzz/pull/10667
4. https://news.ycombinator.com/item?id=39866161
In XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."They also used social engineering to disable fuzzing which would have caught the discrepancy: https://github.com/google/oss-fuzz/pull/10667
In XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."Well Valgrind originally went off on it and oss-fuzz presumably would have caught it since here's a PR from the attacker asking for it to be disabled: https://github.com/google/oss-fuzz/pull/10667
In Debian on xz-utils: revert to version that does not contain changes by bad actorThis PR from July 8 2023 is suspicious, so it was very likely a long con: https://github.com/google/oss-fuzz/pull/10667
In Backdoor in upstream xz/liblzma leading to SSH server compromiseXz: Disable ifunc to fix Issue 60259
18 points · Open discussion>A two years long con with real useful work is a lot of patience and effort vs. just stealing a weakly protected account.
The long-con theory seems a bit more plausible at the moment
https://github.com/google/oss-fuzz/pull/10667
In Backdoor in upstream xz/liblzma leading to SSH server compromiseThis is getting addressed here: https://github.com/google/oss-fuzz/issues/11760
In Backdoor in upstream xz/liblzma leading to SSH server compromise> The above author seems to be primary contact for xz?
They made themselves the primary contact for xz for Google oss-fuzz about one year ago: https://github.com/google/oss-fuzz/commit/6403e93344476972e9...
In Backdoor in upstream xz/liblzma leading to SSH server compromiseLooks like one of the backdoor authors even went and disabled the feature the exploit relied on directly on oss-fuzz to prevent accidental discovery: https://social.treehouse.systems/@Aissen/112180302735030319
https://github.com/google/oss-fuzz/pull/10667
But luckily there was some serendipity: "I accidentally found a security issue while benchmarking postgres changes." https://mastodon.social/@AndresFreundTec/112180083704606941
In Backdoor in upstream xz/liblzma leading to SSH server compromise> because the ifunc code was breaking with all sorts of build options and obviously caused many problems with various sanitizers
for example, https://github.com/google/oss-fuzz/pull/10667
In Backdoor in upstream xz/liblzma leading to SSH server compromiseShowing the 15 most recent of 54 sources. Enable JavaScript to search and browse every indexed mention.