Guy spends 2 years becoming a trusted maintainer of a core software project, then drops in an obfuscated backdoor to allow anyone to log in to a machine and it only gets noticed a month later because one guy noticed it hurt performance. This is the biggest computer security story in years.
