How We Could Have Backdoored Bash (Hacktron blog)

Security researchers using Hacktron compromised the GNU Savannah forge and could have pushed malware into any project hosted there, including upstream Bash, by exploiting an email address such as `` `touch${IFS}/tmp/savane-rce-proof`@attacker.example `` that gave any registered user code execution on the backend. From that foothold the researchers made their account a superuser, impersonated Bash's maintainer, and confirmed they could add an SSH key with push access to the upstream Bash repository; an unpatched kernel then gave them root access and access to a GNU backup server. The researchers reported the findings to the Free Software Foundation on May 11, 2026.