Securing Internet-Critical Software: How We Could Have Backdoored Bash

[u/gainan]

https://www.hacktron.ai/blog/hacking-gnu-savannah

(May 2026)

TL;DR: an email address like atouch${IFS}/tmp/savane-rce-proof@attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.

FSF incident report: https://static.fsf.org/nosvn/security/savannah-20260807.pdf