NewsPublished
Securing Internet-Critical Software: How We Could Have Backdoored Bash
Source Reddit NetSec
0
Discussion
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.
r/netsec (opens in a new tab)u/gainan0 points0 comments
(May 2026)
TL;DR:
- an email address like atouch${IFS}/tmp/savane-rce-proof@attacker.example gave any registered user code execution on its backend.
- From there, we made our account a superuser,
- impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository.
- An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.
FSF incident report: https://static.fsf.org/nosvn/security/savannah-20260807.pdf
Links cited in the discussion
References
Community reviews
Loading reviews…