On: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

[ivlad]

This is literally what the top post link is about. The backdoor functionality has been (roughly) figured out: after decryption and signature verification it passes the payload received in the signing key of the clients authentication certificate to system().

C/C++ is not a problem here because sshd has to run things to open sessions for users.