The XZ Utils backdoor, discovered last week, and the Heartbleed security vulnerability ten years ago, share the same ultimate root cause. Both of them, and in fact all critical infrastructure open source projects, should be fixed with the same solution: ensure baseline funding for proper open source maintenance.\n
it’s safe to assume there are similar issues in closed source. A big part of the snowden leaks was about how NSA could access lots of data at will. It wouldn’t surprise me if they also could execute code.
Also there is stuxnet. But I am not sure, if there were intentional backdoors, or only some “natural occuring” RCE.
They sat on external blue for 5 year before it was stolen and they disclosed the vulnerability to Microsoft.
https://en.wikipedia.org/wiki/EternalBlue
I don’t see why we wouldn’t assume there is always something similar in their armoury.