In March last year, an insidious software supply chain compromise was revealed. The discovery of a backdoor in XZ Utils shook the cybersecurity world, thanks to its technical sophistication and for the bad actor’s methodical patience.
A developer known as “Jia Tan” had spent two years earning trust in the XZ Utils project. The code they contributed was clean. Until it wasn’t.
Hidden inside liblzma.so sat a backdoor. It came to life when a client connected to an infected SSH server. It hooked into critical cryptographic functions: RSA_public_decrypt, RSA_get0_key, and EVP_PKEY_set1_RSA, granting the attacker silent access.
Debian, Fedora, and OpenSUSE shipped the poisoned packages. This was a supply chain compromise on a scale that left little untouched. Within a day, Binarly released XZ.fail, a free tool to detect malicious IFUNC resolvers.
The story should have ended there. It hasn’t.
Old Poison in New Bottles
Binarly has found the backdoor again. This time in Docker images.
At least 12 Debian-based images on Docker Hub still carry the malicious code. More than 35 in total show signs of infection. Some of these images were used to build others. The infection spreads silently through “second-order” images, and likely beyond.
Binarly’s scan covered only a fraction of Docker Hub. They focused on Debian because it keeps historical image data. The extent of infections in Fedora, OpenSUSE, and other distributions remains unknown.
The findings come from a 15-terabyte dataset of Docker images. Binarly used it to sharpen its detection tools, searching for the same ELF file anomalies and IFUNC hooks seen in the original compromise.
They found them.
A Chain That Keeps Building
Second-order infections mean the risk is not frozen in time. Each compromised base image can spawn new images. Those, in turn, can be reused again. Third-order, fourth-order, and so on.
Tracking this is hard. Docker Hub holds almost 12 million repositories. Many have hundreds of images. There is no direct way to trace every descendant. Binarly resorted to manual mapping and targeted searches.
Some infected images are outdated. Others are tagged as the latest build. That means developers (or automated systems) could still be pulling them into active use.
Warnings Unheeded
Binarly notified Debian maintainers and asked for removal of the images. They remain online.
The persistence of this backdoor is a warning. Supply chain compromises do not vanish when patches land. Copies survive. They are cached, forked, republished. They wait for someone to pull them into a live environment.
The XZ Utils backdoor was a lesson in patience and precision from an attacker. Its lingering presence in Docker images is a lesson in how long a breach can echo.
Information Security Buzz News Editor
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
Alex Greenwood said her mum loves to squirrel her medals away for herself
Double Euros-winning Lioness Alex Greenwood said there is always a playful “fight” with her mother as to who gets to keep her medals whenever she wins a tournament.
The Merseyside-born Manchester City captain said: “She’s straight away saying ‘that’s mine, make sure they get brought home’.”
“It happens more often than not,” she joked.
Greenwood also said she was delighted with how the women’s game continues to grow, and felt it was important that “young girls can turn on the TV and have idols in our game”.
Reuters
Alex Greenwood (right) with Beth Mead (centre) and Alessia Russo (left) during the Lioness Victory Parade
Greenwood, who played every game as England defended their Euros title, also said joining the open top bus parade through the streets of London was a “pinch yourself moment”.
“It was one of the best things I’ve ever experienced in my life,” she said.
“It was incredible.
“I think a couple of us were… elbowing each other saying ‘wow, take this in, because this is really, really special and you just never know if that’s ever going to happen again’.”
PA Media
Greenwood scored in the penalty shootout against Spain
The Lionesses’ back-to-back victories at European Championships has had a remarkable impact on grassroots womens football.
Even before Euro 2025, the number of women’s and girls’ teams across the country had doubled in seven years.
Greenwood said she thought that was down to the fact “young girls can turn on the TV and have idols in our game”.
She said the Lionesses talk about the feeling they get when they arrive at games and they see “the names of players’ shirts on the back of little girls’ tops”.
‘I love winning’
Born in Bootle in Sefton, Greenwood played for Everton, Liverpool, and Manchester United, before becoming Manchester City captain.
England did things the hard way at Euro 2025, requiring nervy comebacks in all three of their knockout games.
However, Greenwood said inside the camp they were not as nervous as the England fans.
“For us, it’s probably slightly easier to stay relaxed because we’re in it and we’re in control of it and we’ve prepared for these moments time and time again,” she said.
Her trophy cabinet is now full to the brim – including two European Championships, a Champions League, a league title in France and an FA Cup.
But she said she still wants more.
“Ultimately I really, really love winning,” she said.
“I love lifting trophies, I love being successful and I love making my family proud.”
Japan’s five-year government bond auction saw the lowest demand since 2020 amid the prospect of tighter monetary policy and renewed concerns over poor market liquidity.
The sale nudged bond prices lower across maturities from two- to 20-years, and yields on five-year securities rose as much as 3 basis points to 1.07% before easing slightly. The bid-to-cover ratio was 2.96, compared with 3.54 at the prior sale and the 12-month average of 3.74.
There has been an increase in the number of butterfly sightings in Guernsey as part of an annual count, the island’s Nature Commission has said.
Citizen scientists have logged 282 butterflies in Guernsey this year, compared with 89 last year.
It is part of the national survey organised by the Butterfly Conservation which finished on Sunday 10 August.
Islanders were asked to log their data on the bailiwick map by the end of August.
The Nature Commission’s head of operations and education Angela Salmon said the team was “thrilled” with the engagement this year.
She said: “So many more people [have been] taking part out and about in nature and enjoying butterflies.”
It followed a social media campaign and talks given in schools to encourage people to join in.
People were asked to spend 15 minutes in their garden or on a walk recording the number and variety of butterflies they spotted to help build up a picture of the insects this summer.
The final number of butterflies seen, the number of counts, number of citizen scientists and the top butterflies are likely to be available in September.
Chris Turner (L) of Chiltern Vital Group and Bill Eden from Quantum Leap Energy are working on the plans at the former Berkeley nuclear power station
Two nuclear energy companies have signed deals to create technology centres at a former nuclear reactor site.
Berkeley nuclear power station in Gloucestershire was shut down in 1989, but a developer now wants to build a “nuclear centre of excellence” on the site.
Quantum Leap Energy and Astral Systems have signed deals to set up plants there.
Bill Eden, from Quantum Leap Energy, promised “hundreds of jobs” creating fuel for nuclear fusion.
He said: “Nuclear fusion is now the technology of tomorrow, not of distant years.”
Chris Turner, CEO of developers Chiltern Vital Group, said Berkeley will become “the centre of the world” in nuclear, low carbon, green technologies, and “up to 1,000” jobs would be created if the plans went ahead.
In the shadow of the old reactor lies a maze of old buildings, mostly empty and derelict. Lying next to the River Severn at the end of a single track road, it’s a quiet place. And the former nuclear station, still being decommissioned, lends it a chilling edge.
The man who has bought the site has big dreams. Mr Turner’s “centre of the world” comment is a bold claim, the sort many people make, so I asked him to introduce me to some real investors.
Chiltern Vital Berkeley
The plants would be built next to the former Berkeley power station
He found two. Bill Eden works for the UK arm of American firm, Quantum Leap Energy. Like most of the firms in this venture, the technology is complex. But my basic understanding of it is that they make fuel for the nuclear fusion industry.
“Nuclear fusion?”, I asked Mr Eden, “is that a thing yet?”
“There is so much research going on,” he reassured me. “It needs specific fuel to make it work, and we are going to produce that here, at Berkeley.”
He said they could be commercial within two years.
‘Targeted radiotherapy’
Talmon Firestone’s tech is even harder to get to grips with. Also nuclear, but this time harnessing physics for medicine.
“This is targeted radiotherapy,” he explains.
“Far more effective, and far more pleasant for the patient.”
Nuclear medicine is not new tech. Hospitals round the country use it all the time to find and treat cancer. Small amounts of radioisotopes are injected, which find their way direct to tumours. Once there, they show up under scans so the extent of disease can be identified.
The same technology can also be used to direct radiotherapy specifically to the site of the cancer.
But the UK has to import all the vital radioisotopes used in this medicine from reactors in Europe.
In 2024, the supply chain was interrupted when two of them shut down for planned maintenance at the same time, and then the third sprung a fault.
“Something like 75% of our supply was lost,” said Dr Stephen Harden, from the Royal College of Radiologists.
“It makes a really strong case for making these radioisotopes in the UK.”
Talmon Firestone (L) and Dr Tom Wallace-Smith say their new fusion reactor will supply hospitals with vital nuclear medicine materials
Working with Dr Tom Wallace-Smith of Bristol University, Mr Firestone’s company has found a new way to make these vital nuclear ingredients, without using a big nuclear fission reactor.
He showed me his latest array, a steel tube barely two metres tall.
The problem is that to run his fusion reactors at full strength they need serious protection. At Berkeley, there is an old building, called C35, which is just the trick.
“C35 has a deep bunker, created to store nuclear waste, but never actually used,” he smiled.
“For us, it’s the perfect place to carry out our research, and then eventually produce the radioisotopes at scale.”
Scientists at Astral Systems labs in Bristol are using nuclear fusion to create radioisotopes used by doctors to treat cancer
Old, unused bunkers, nuclear fusion fuel, buildings with codenames, it’s all very sci-fi.
Mr Turner clearly relishes it all. And he has more, he says, in his nuclear pipeline.
“We’re negotiating with the South Koreans about world-leading maritime nuclear technology.
“We’re talking to a whole range of international companies about different nuclear and zero carbon technologies.”
Developers always make big claims, it’s their business. Chiltern Vital Group is about to submit a planning application and then will have to deal with more mundane matters.
Among them, how a small country road will cope with hundreds of tech workers commuting down it every day.
Transport links needed
The promise of new jobs was welcomed by Berkeley town councillor, Liz Ashton.
“It will generate lots of high level tech jobs which is what we need in the area.
But she raised concerns about the impact of the development on transport links.
“There are lots of problems regarding the motorway junctions. They really need to revive a good public transport system, so people won’t be coming in their cars.”
Lloyd Wakefield on the red carpet for the 2023 iHeart Radio Music Awards
As thousands of students across the UK open their exam results, many are getting ready for the next big step: university.
But that path isn’t for everyone – and it doesn’t have to be.
BBC News spoke to four former pupils who chose a different route and still landed their dream jobs.
From working with animals at Chester Zoo to photographing Harry Styles on tour, their stories show that skipping university doesn’t mean missing out on success.
‘Don’t rush it’
When 29-year-old Lloyd Wakefield was growing up in Stockport, he didn’t imagine his future behind a camera, and certainly not on tour with one of the biggest pop stars in the world.
“Up until college, my only goal was to be a footballer,” he says.
“I’m not the most academic. I didn’t click with any lessons outside of PE. I’m a hands-on person.”
When football didn’t work out, he took a job at Aldi.
“It took me two years to adjust, to find any kind of direction or purpose outside of football,” he says.
He “caught a bug” for photography through a friend’s film camera, spending their days off going out and taking photos together.
Teaching himself through YouTube and lots of trial and error, Lloyd began messaging agencies and chasing opportunities. That led him to a backstage gig at Fashion Week, and eventually to photographing Harry Styles’ Love On Tour.
“If you told me when I was working in Aldi that I’d be in the music world, on a tour, it was so polar opposite of where I thought I was going to be.”
Lloyd Wakefield
Lloyd Wakefield with Emma Corrin, star of The Crown
His work at Love On Tour landed him the title of favourite tour photographer at the 2023 iHeartRadio Awards. He has also worked with other celebrities and brands such as Dua Lipa, EA, UFC and Arsenal FC.
Today, Lloyd runs Lloyd’s Workshop, a creative community for young photographers without connections or formal training.
His advice for other young creatives is to take their time.
“There’s no shame in getting a normal job,” he says.
“Use it to fund your passion. Don’t rush it.”
Looking back, he says choosing not to go to university was the right call for him.
“I learned way more by just kind of putting myself in those situations on set. The benefits vastly outweigh the negatives.”
‘Just go for it’
Chester Zoo
Frazer completed a Level 3 zookeeping apprenticeship at Chester Zoo after his A-levels
Frazer Walsh’s journey to working with lions didn’t begin in a lab or lecture hall – it started with a job advert he spotted by chance.
“I applied for three different universities but I didn’t want to go – it was just because I felt I had no other option,” he says.
“Then I saw a Chester zookeeping apprenticeship listed and thought: ‘Oh my god, that’s my dream, it’s something I’ve always wanted to do.’”
The 21-year-old, from Widnes in Cheshire, was “obsessed” with animals from a young age, he says, driving his mum “insane” with his love of David Attenborough.
But he had no idea how to turn that into a career.
“You don’t really hear of many zookeepers, or if you do, you don’t really know how they got into that position in the first place,” he says.
Chester Zoo
Frazer feeding the otters at Chester Zoo
Now a qualified keeper, Frazer is thriving.
“About a year into the apprenticeship, I was finally able to work with the lions by myself. They’re your responsibility then, you’re looking after them, and you take a lot of pride in it.
“That is something that I’ll always keep with me.”
Frazer’s advice to school leavers is similar to Lloyd’s.
“Just don’t rush it, because it’s your life, isn’t it?” he says.
“A job like this is really once in a lifetime, so just go for it.”
‘It’s okay not to have it all figured out’
Thaliqua Smith
Thaliqua Smith with rappers Big Zuu (left) and AJ Tracey (right) on set for Big Zuu & AJ Tracey’s Rich Flavours
For south Londoner Thaliqua Smith, film-making was always the dream, but going to university to get there just didn’t feel right.
“I just felt like school should be done,” she says.
“They were saying the only way for me to get into [directing and producing] was to go and do further studies. But it just wasn’t something that I was particularly interested in.”
After her dad suggested she look into an apprenticeship, Thaliqua found the Channel 4 production training scheme.
“It just sounded really cool,” she says.
“I thought, ‘Wow, this is great. I’m working, I’m learning for a year. I’m earning money for a year in a field that would be amazing.’”
Thaliqua was one of just 10 people selected for the first year of the scheme. From day one, she says she knew she was in the right place.
Thaliqua Smith
Thaliqua originally wanted to be an actor before finding her love of production.
Now 25, she’s worked on shows like The Apprentice, Naked Attraction, and Rich Flavours with Big Zuu and AJ Tracey. She’s filmed abroad in Spain and New York and has moved up to the role of assistant producer.
“I didn’t travel much as a kid, so to be flown to amazing places, staying in beautiful hotels, meeting insanely cool people – it’s a dream come true.”
Now she says she’s passionate about spreading the word.
“Apprenticeships are amazing, [but] I had to dig through Google to find mine. They should be promoted way more.”
Her advice is to “not let anyone convince you you can’t do something”.
“It’s OK to not have it all figured out,” she says.
“Even people who act like they’ve got it figured out probably don’t.”
Turning a hobby into a career
Faye Husband
Faye, from Teesside, started her own nail business after doing her own as a hobby
Faye Husband’s school years were far from typical.
Diagnosed with chronic fatigue syndrome, as well as Pots – a condition which causes dizziness – and hypermobility, she struggled with attendance and anxiety.
“I had a lot of time off and it was hard managing being off and then coming back to school and teachers and friends not understanding,” the 19-year-old says.
She eventually left mainstream school and was homeschooled before joining a support unit called Strive.
“That literally gave me my GCSEs – I probably wouldn’t have managed them if I wasn’t there,” she says.
After going to college and earning A-levels in criminology and psychology, Faye still wasn’t sure about university. That’s when her parents suggested turning a hobby into a career.
“I’d done my own nails for years and my mum and dad said, ‘Why don’t you do a course and do it for other people?’”
Faye Husband
Faye is often booked a month in advance
Working from a converted garage at home in Redcar, she now runs her business Phaze Nails which is often booked up to a month in advance.
Being self-employed has given Faye the room to thrive despite her health struggles.
“I’ve met so many nice people and made really strong friendships from it,” she says.
“That’s usually stuff I don’t get the opportunity to do, because I don’t go out a lot.”
Faye says young people should not put too much pressure on themselves.
“Be kind to yourself,” she says.
“Don’t rush yourself into doing something that you’re not ready to do.”
Roxanne Freeman built up her online following while working as a slimming consultant
“This has been the turning point for me – it’s improved my confidence, my own self-belief.”
Single mum Roxanne Freeman says she lived beyond her means and used her credit cards to support her family, even using one to put down a deposit on a caravan.
She had racked up £13,000 worth of debt by summer 2023, but her fortunes changed after she turned her hand to content creation, filming and posting reviews of plus-size clothing on TikTok.
The 36-year-old from Leicester earns commissions on her videos – up to £5,000 a month now, she says – and has cleared her debt.
Roxanne is among a growing number of people turning to social media to boost their income and says: “It’s literally life-changing.”
Roxanne says she can now afford to do more with her sons
Roxanne was working as a Slimming World consultant when she bought a dress from TikTok Shop and filmed herself trying it on before posting a review for her 1,000 followers in February 2024.
She says she earned £200 in commission from the dress manufacturer in a week – 10% for each one bought via the link she posted with her video – and was soon approached by other companies offering her samples to review.
“In my second month I earned £600 and it just went up and up gradually,” she adds.
“I’m now earning up to £5,000 per month from just two to three hours’ work a day, it’s insane.”
‘Imposter syndrome’
Roxanne, who now has almost 50,000 followers, has since left her slimming consultant job and relies solely on her income from TikTok.
She says her earnings vary each month depending on her followers, but she has earned enough to pay off her debts and to do more with her sons, aged six and 10.
“I took the kids on holiday – my youngest boy had never been abroad before,” she says.
“Sometimes imposter syndrome does sneak in a little bit and I worry, but you could lose any job tomorrow.”
Holly and Diego Hernandez’s TikTok account has almost 300,000 followers
Like Roxanne, married couple Holly and Diego Hernandezalso earn money by posting videos on TikTok.
Holly, from Leicester, and Diego, from Mexico, met on the social media platform when they were 16 and went on to set up an account to document their relationship and daily life.
The couple now have almost 300,000 followers and earn up to £5,000 a month, but they have both kept their day jobs – Holly, 22, is a nurse and Diego, 23, works for a medical supply company.
Some of their income comes via the TikTok Creator Fund, which pays users for their content.
To be eligible, creators must be 18 or older, have 10,000 followers or more and have had at least 100,000 video views in the 30 days before applying to join the fund.
For Holly and Diego, who live in Leicester, they are paid according to their video interactions.
They are also paid by record labels to play particular songs in the background of their videos.
Due to their success, the couple have become a limited company – registered with Companies House – and have signed with a management agency.
Diego and Holly have both kept their day jobs
Holly says: “We were so young when the money came in, and we were going on amazing holidays and buying things.
“I wish there was somebody back then who guided us, because I think we would have invested or saved it.
“In the beginning, I was trying to manage the monetary side of it myself and I found it really overwhelming.
“Things like taxes came into play, so we ended up getting an accountant and becoming a limited company.”
The couple post videos most days but admit there are negatives to sharing their lives so openly.
“I think the biggest downside is the trolls,” says Holly.
“There’s always someone hounding you because of our relationship or the way that we look, the way we speak or the way we dress.
“It can get to you when it’s constant.”
Estelle Keeber says “influencer marketing is here to stay”
Estelle Keeber, also from Leicester, started a Facebook group aimed at female business owners in 2017 and, after gaining a large following, started charging for her social media expertise.
The 42-year-old says she turned over £1.2m in the first two years and now runs a social media marketing consultancy firm called Immortal Monkey.
“Whether you want to be an influencer or an affiliate marketer, there has never been a better time for people to be jumping in,” she says.
“But it does takes time, it takes a lot of hard work, especially if you’re building a brand around yourself. It is constant hard work.”
Estelle is now setting up a community interest company to link influencers with schools to educate the next generation on content creation.
“I think influencer marketing is here to stay because it’s an organic way of marketing,” she says.
“Nobody wants to be sold to, whereas when it’s organic, people trust and believe in that person – and the bigger brands are really understanding this now.”
‘Big, fat juicy tax bill’
According to Statista, a global data and business intelligence platform, there are 54 million social media users in the UK and 84% of adults follow an influencer.
But anyone who makes a living from or supplements their income by posting content online is subject to the same tax laws as everyone else.
According to Revenue and Customs, income from creating online content includes gifts and services received from promoting products on social media.
If someone’s total income is more than the £1,000 allowance for the tax year, including any gifts and services received, they must tell HMRC about it.
Zubair Ali, managing partner of MyTaxDoc Accountants, based in Birmingham, says three in 10 of the firm’s clients are social media influencers.
“Just because you’ve got a million followers, HMRC won’t let it slide,” Zubair says.
“The last thing anyone wants is a big, fat juicy tax bill which they haven’t got the means to pay for.”
