SSH backdoored by xz compression library in Fedora 40 Beta, Fedora Rawhide, Debian Sid, openSUSE Tumbleweed (+ likely other distros)

Privacy
24

Looks like master merged 5.6.0 on Feb 28, so essentially it was in master all March.

However, none of the release tags seem to have merged versions >5.4.6.