Sign up for freeSign up

Security Advisory: The xz Backdoor – passive reporting structures for security advisories

Students learn passive reporting structures such as is believed to in this C1 English for IT lesson plan on writing a security advisory.

Grammar
The impersonal passive (It is said that…), the personal pattern with a to-infinitive (The bug is believed to affect…) and plain passives for confirmed facts.
Topic
The xz backdoor of March 2024 and a fictional payments startup's internal advisory on it, with words such as supply-chain attack, maintainer, sock puppet and compromised.
Activities
An article and the advisory to read, a talk to hear, self-checking drills, a chat and a speaking wheel, then an advisory to write and a briefing to record.

What's inside

  1. Chapter 1Warm-up: trust, but verify

    • PictureUnlock
    • Open a box and discussOpen the boxUnlock
    • Study the vocabulary: when a dependency turns against youVocabularyTry it
    • Match the jargon to the plain-English versionMatchUnlock

  2. Chapter 2Reading: half a second too slow

    • Read the article: the slow login that exposed a backdoorArticleUnlock
    • Choose the correct answer: what happened?QuizUnlock
    • Read Kestrel's internal advisory from March 2024Real-life documentTry it
    • True or false? Check the advisoryTrue or falseUnlock

  3. Chapter 3Listening: facts first, Rui

    • Listen to Lena and RuiListeningTry it
    • Transcript, for the teacherUnlock
    • Choose the correct answer: what did Lena say?QuizUnlock

  4. Chapter 4Grammar: fact or suspicion?

    • Study the scheme: passive reporting structuresGrammar schemeTry it
    • Choose the correct optionChoose the optionUnlock
    • Fill in the table: write each note as a fact and as a suspicion, in the note's tenseFill in the tableTry it
    • Fill in the gaps: rewrite the reportsFill in the gapsUnlock
    • Choose the correct answer: fact or suspicion?QuizUnlock

  5. Chapter 5Speaking: no panic, just precision

    • Choose the best replies: Graham has seen a headlineChatTry it
    • Spin the wheel and speakSpin the wheelUnlock

  6. Chapter 6Homework: write your own advisory

    • Fill in the gaps: rewrite the notes for the advisoryFill in the gapsUnlock
    • Drag the words into the gaps: Rui's notes for the next new joinerDrag and dropUnlock
    • Write a security advisory for a made-up libraryWriting, checked by the teacherUnlock
    • Record a security briefing for your teamSpeaking, checked by the teacherUnlock

22 exercises in 6 chapters. Start a 7-day free trial to open all of them, copy any part into your own lessons, and teach the lesson live.

Cybersecurity vocabulary

10 words and phrases from the lesson, each with a picture and audio in edio.

+7 more with pictures and audio in the lessonMore words

  • tarball
  • sock puppet
  • compromised
  • rolling release
  • disclosure
  • as a precaution
  • downgrade

Grammar: passive reporting structures

A security advisory has to say what is known and what is only believed, because readers act on the difference. Learners state confirmed facts with plain passives (A backdoor has been found) and report the rest with a passive reporting verb: the impersonal It is believed that… or the personal The backdoor is believed to…, as in an advisory on the xz backdoor of 2024.

Fact or suspicion? Passive reporting structures

A good advisory states facts plainly and reports what is only believed. The grammar keeps the two apart.

Fact or suspicion?

An advisory keeps two kinds of sentence apart. Confirmed facts take a plain passive: Our production servers were checked. They were not affected. Anything unconfirmed is reported: The other accounts are suspected to have been fake.

Confirmed: plain passive (be + past participle)

  • A backdoor has been found in XZ Utils 5.6.0 and 5.6.1.
  • Our production servers were checked. They were not affected.
  • The logs are being reviewed right now.
  • The xz package should be downgraded to 5.4.6.

Not confirmed: report it

  • The old runners are not thought to have been compromised.
  • The other accounts are suspected to have been fake.
  • It is believed that two more images contain the old version.
  • It is not known who was really behind "Jia Tan."

It is said that…: the impersonal pattern

The impersonal pattern starts with an empty it, then the passive verb and a that-clause: It is thought that a bot is scanning our API. No source is named, which suits news, reports and advisories.

Itis + said, thought, believed, reported, known, understoodthat + clause

It is thought that a bot is scanning our API.

It is known that the account first contributed in 2021.

It is understood that the vendor will ship a fix on Monday.

The bug is believed to…: the personal pattern

The personal pattern puts the real subject first and goes on with a to-infinitive that shows the time: is believed to affect (same time), to be scanning (in progress), to have fixed (earlier), to be affected and to have been accessed (passive).

Pattern 2: subject + passive + to-infinitive

subjectbe + said, thought, believed, reported, known, understoodto-infinitive

A bot is thought to be scanning our API.

The vendor is said to have fixed the bug.

Two images are believed to contain the old version.

Which infinitive? Look at the time

The action…InfinitiveExample
happens at the same time as the report (a state or habit)to + verbThe bug is believed to affect every 2.x release.
is in progress nowto be + -ingA bot is thought to be scanning our API.
happened before the reportto have + past participleThe vendor is said to have fixed the bug last night.
happens now and is done to the subjectto be + past participleTwo images are believed to be affected.
happened before and was done to the subjectto have been + past participleThe runners are not thought to have been accessed.

There are believed to be…

With there, the verb agrees with the noun after to be: There are believed to be two more old images in staging. There is not thought to be any risk to production.

Thereis / are + thought, believed, saidto be + noun

There are believed to be two more old images in staging.

There is not thought to be any risk to production.

Choose the verb that matches your evidence

Known and confirmed mean proof; reported and said mean others say so; believed and thought give the best guess; understood means you've been told, unofficially. Suspected means signs without proof.

Choose the verb that matches your evidence

known, confirmed: you have proof. reported, said: others say so, but you haven't checked. believed, thought: the current best guess. understood: you've been told, but it isn't official yet. suspected: there are signs, but no proof. Use a plain passive or known for facts, and the other verbs for everything that isn't confirmed.

Typical mistakes

  • It is believed the bug to affect every release.

    It is believed that the bug affects every release.

    With It, use a that-clause. Or start with the subject: The bug is believed to affect every release.

  • The vendor is said to fix the bug last night.

    The vendor is said to have fixed the bug last night.

    An earlier action needs to have + past participle.

  • The incident is investigating by the security team.

    The incident is being investigated by the security team.

    The incident doesn't investigate anything. In progress now: is / are being + past participle.

  • There is believed to be two more old images.

    There are believed to be two more old images.

    The verb agrees with the noun after to be: there are + plural, there is + singular.

More lessons on this grammar: Passive voice lessons and exercises

Try the passive reporting structures exercises

Try them yourself: these are the same exercises your students do in edio.

More exercises

What's in the lesson

  • 11 auto-checked exercises
  • 2 games
  • 2 teacher-checked tasks
  • 1 real-life document
  • 1 article
  • 1 grammar scheme
  • 1 set of word cards
  • 1 audio clip
  • 1 picture
  • 1 transcript

The main objectives of this lesson are to:

  • report what isn't confirmed: It is thought that a bot is scanning our API. The old runners are not thought to have been compromised.
  • choose the infinitive by time: is believed to affect, to be scanning, to have fixed, to have been accessed
  • match the verb to the evidence: known for proof, said or reported for claims, suspected for signs without proof
  • write a security advisory that keeps confirmed facts apart from suspicions, and brief a non-technical manager calmly

Lesson 7 of English for IT C1 · Across the Company opens unit 3, Security and design, which covers advisories, trade-offs and RFCs. It carries the hedging of lesson 2, seem to and appear to, into the reporting verbs of formal writing, and lesson 8 goes on to weigh design trade-offs with concession and contrast. In a security incident, the line between known and believed decides what people do next.

Students open boxes of security questions, then learn ten words such as tarball, rolling release and as a precaution with pictures and audio, and match jargon to plain English. The reading chapter tells how a login half a second too slow exposed a backdoor in XZ Utils, then gives an internal advisory from a fictional payments startup, with confirmed facts in one section and beliefs in another. In the AI-voiced listening, Lena walks Rui, a new joiner, through it. Four exercises that check themselves follow the scheme, including a table where each note becomes a fact and a suspicion. The speaking chapter has a chat with Graham, the CFO, who has seen a headline, and a wheel of prompts.

Homework starts with two self-checking exercises: notes to rewrite as reporting structures and a drag-and-drop of the security words. Students then write an advisory for a made-up library and record a security briefing, and the teacher reviews both.

Grammar:
passive reporting structures · passive voice
Topic:
cybersecurity · open source · security advisories

Teaching tips

  • Sort headlines into fact and suspicion: bring three tech news headlines and have students rewrite each claim twice, as a plain passive and with is reported to or is thought to.
  • Build an evidence scale on the board, from suspected through believed and reported to known: read out a claim, and students place it on the scale and choose the verb.
  • Rewrite a real status update: in-company learners bring an anonymized alert or incident message and rewrite it so that every unconfirmed claim is reported, not stated.
  • Play Graham in a one-to-one class: as the non-technical manager, ask Are we hacked? and push for a yes or no, while the learner answers with what is known and what is only believed.

Liked it?

Teach the whole lesson in edio

22 exercises in 6 chapters, ready to teach. edio is an online platform for language schools and teachers: ready-made interactive lessons, live classes, homework and student progress in one place.

  1. Start a free trial

    7 days, no credit card.

  2. Open the lesson

    Find it in the library of 621 ready lessons. Teach it as it is, or copy any chapter into your own lessons.

  3. Teach it live or as homework

    Students work in their own accounts, in sync with you during the lesson, and the practice exercises check themselves.

Teach it free for 7 days

The whole course: English for IT C1 · Across the Company

15 lessons at C1 for people who build software, in American English, with definitions instead of translations. The people of Kestrel Cloud, a fictional payments startup, write updates, reviews, RFCs and postmortems, explain tech to non-tech colleagues and negotiate scope. Real cases include the CrowdStrike outage and the xz backdoor.See the course

  1. Unit 1 Talking to the team

    async updates, code review and plain explanations: the future perfect, hedging, cleft sentences

    1. Lesson 1Async Stand-ups: Status Updates People Can Act OnFuture forms for status updates
    2. Lesson 2Code Review Without the DramaHedging in code review
    3. Lesson 3Explaining Tech to Non-Tech PeopleIt-clefts and wh-clefts

  2. Unit 2 Shipping and incidents

    estimates, releases and outages: conditionals without if, phrasal verbs, modal perfects

    1. Lesson 4Estimates, Deadlines and Saying No (Politely)Conditionals without if and mixed conditionals
    2. Lesson 5Release Day: Rolling Out and Rolling BackPhrasal verbs and their noun forms
    3. Lesson 6Incident! Learning from the CrowdStrike OutageModal perfects and narrative tenses

  3. Unit 3 Security and design

    advisories, trade-offs and RFCs: passive reporting structures, concession and contrast, nominalization

    1. Lesson 7 · you're hereSecurity Advisory: The xz BackdoorPassive reporting structures
    2. Lesson 8System Design: Every Choice Has a CostConcession, contrast and modified comparatives
    3. Lesson 9Writing an RFC That Gets ApprovedNominalization and formal register

  4. Unit 4 Docs, metrics and meetings

    READMEs, dashboards and follow-ups: participle clauses, describing trends, reporting verbs

    1. Lesson 10Docs People Actually ReadReduced relative clauses and participle clauses
    2. Lesson 11Metrics, Dashboards and SLOsPrepositions with numbers, trends and approximation
    3. Lesson 12Meeting Notes and Follow-upsReporting verbs and their patterns

  5. Unit 5 Retros, interviews and AI

    looking back and ahead: wish and would rather, inversion, formal obligation and permission

    1. Lesson 13The Retro: What Went Wrong This QuarterWish, would rather and it's high time
    2. Lesson 14The Interview: Selling Your AchievementsInversion for emphasis
    3. Lesson 15AI at Work: Writing the Team's RulesObligation and permission in formal rules

Questions about this lesson

What is the impersonal passive?
The impersonal passive is it plus a passive reporting verb and a that-clause: It is said that…, It is believed that…, It is known that…. The it is empty and no source is named: It is thought that a bot is scanning our API. A personal version puts the real subject first: A bot is thought to be scanning our API. Both are typical of news, reports and security advisories.
How do you use "it is said that"?
Use it is said that to report what others claim without checking it yourself: It is said that the vendor has fixed the bug. The same claim often reads better with the subject first: The vendor is said to have fixed the bug. For proof, write it is known; for a best guess, it is believed or it is thought. The pattern sounds formal, so it suits written reports more than chat.
When do you use passive reporting structures?
Use passive reporting structures when a claim isn't confirmed or its source doesn't matter, as in news, reports and security advisories. They keep facts apart from suspicions: Our production servers were checked and were not affected is a fact, while The old runners are not thought to have been compromised is a careful belief. The C1 English for IT lesson Security Advisory: The xz Backdoor on edio.ai builds a whole advisory on that split.
What are passive reporting verbs?
Passive reporting verbs are verbs like said, thought, believed and known in the passive, used to pass on information without naming its source. Each one signals how strong the evidence is: known and confirmed mean proof, reported and said mean others claim it, believed and thought give a best guess, and suspected points to signs with no proof yet. Alleged, expected and considered follow the same patterns.
What's the difference between "it is reported that" and "is reported to"?
They report the same claim with different subjects. It is reported that the attackers stole a deploy key starts with an empty it and a that-clause; The attackers are reported to have stolen a deploy key starts with the real subject and a to-infinitive. Don't mix the two: It is reported the attackers to have stolen… is wrong. The subject-first version puts the focus on who did it.
How do you use "is believed to"?
Is believed to reports a best guess, followed by an infinitive that fits the time: to affect for now, to be scanning for an action in progress, to have fixed for an earlier one. So it's The vendor is believed to have fixed the bug last night, never to fix the bug last night. On edio.ai, a table in Security Advisory: The xz Backdoor drills these forms.
What is a supply chain attack?
A supply-chain attack is breaking in through software or vendors a target trusts, instead of attacking the target directly. In the xz backdoor of 2024, the way in was not OpenSSH itself but a dependency of a dependency: some distributions patch OpenSSH to load libsystemd, which in turn loads liblzma from XZ Utils. The term is written with or without a hyphen: a supply-chain attack, a supply chain attack.
How do you write about the xz backdoor in a security advisory?
State confirmed facts plainly and report the rest: A backdoor has been found in XZ Utils 5.6.0 and 5.6.1. Our production servers were checked. They were not affected. Then the unconfirmed part: It is not known who was really behind "Jia Tan." The other accounts are suspected to have been fake. Close with actions, such as downgrading to 5.4.6, as CISA advised. The advisory on this page splits its points the same way.
How do you explain a security incident to a non-technical manager?
Lead with the answer they need, in plain words, then separate what is confirmed from what is still believed: Not as far as we know. A backdoor has been found in XZ Utils, a Linux compression library, and our systems are being checked right now. Explain the risk without jargon: Someone hid a secret entrance in a tool that many Linux systems use. End with what they need to do, if anything.
How do I teach passive reporting structures?
Start from the need to separate proof from belief. Give learners notes from an investigation and ask for each one twice, as a fact (The staging servers were accessed last week) and as a suspicion (The staging servers are thought to have been accessed last week). Then teach the infinitive by time: now, in progress, earlier. On edio.ai, Security Advisory: The xz Backdoor pairs this drill with a real case, the xz backdoor.
What's good homework for practicing passive reporting structures?
Good homework is a short advisory with separate confirmed and unconfirmed sections, about a clearly made-up library. In Security Advisory: The xz Backdoor, a C1 lesson on edio.ai, two self-checking exercises come first: notes to rewrite with is thought to or is reported to have, and the security words to drag into place. Students then write the advisory and record a briefing, and the teacher reviews both.
Are there interactive exercises for passive reporting structures?
Yes: table drills and chats that check each answer make learners choose fact or belief. This page plays four parts of Security Advisory: The xz Backdoor, a C1 lesson on edio.ai, with no sign-up: a fictional startup's internal advisory from March 2024, Lena and Rui's talk about it, a table that turns investigation notes into facts and suspicions, and a chat with Graham, the CFO, who has seen a headline. The rest is locked.
Unlock full lesson

Teach this lesson with your students

Book a demoStart free trial

No credit card required