decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable." — Bluesky

A preliminary analysis reveals that the xz backdoor utilizes a fixed Ed448 key to verify the server's host key and then executes a payload through system(), resulting in remote code execution.