A ‘Janus’ attack! Funky bug-o’-the day is CVE-2026-5704 in the venerable GNU ‘tar’ utility. Tar is short for “tape archive,” and it’s one of the oldest and most widely-used package download formats around. (When you see files called *.tgz, or *.tbz, or *.txz, those are just tar archives that have subsequently been compressed.) Each entry in the archive has a name, a list of access permissions and other attributes, a size, and (size) bytes’ worth of data. Some filenames, such as Unix or Windows symbolic links, refer to other files and don’t have any data of their own, so they are supposed to be stored with a size of zero, and zero bytes of data. Except that GNU tar doesn’t check that archive items that shouldn’t have any data don’t have any data. And it handles “no-data” objects differently depending on whether you *list* the archive (to see if it has any unwanted stuff in it) or you *extract* it. When you list the contents, the program just skips over any data attached to any “no-data” files, without warning you about the presence of data that shouldn’t really be there. But when you extract the archive, the program *doesn’t* skip over the unwanted data - it starts looking for the next archive item right away. So, if the “injected data that shouldn’t be there” has the same format as a regular entry in the archive… the program extracts it! Those “injected data” files will therefore be hidden from view when you list the archive, yet will automatically be extracted when you unpack the very same archive :-) If you’re a programmer, make sure you don’t let multiple, inconsistently coded error-checking routines creep into different parts of your project. (Be extra careful if you let some kind of vibe coding tool loose on different parts of a problem at different times!) PS. The name ‘Janus attack’ comes from the Ancient Roman deity Janus, who was literally two-faced, one on each side of his head.