How We Could Have Backdoored Bash (Hacktron blog)

The Hacktron blog documents howthe group was able to compromise the GNU Savannah forge and could havepushed malware into any of the projects hosted there.

Using Hacktron, we found that an email address likea`touch${IFS}/tmp/savane-rce-proof`@attacker.example gave anyregistered user code execution on its backend. From there, we madeour account a superuser, impersonated Bash's maintainer, andconfirmed we could add an SSH key with push access to the upstreamBash repository. An unpatched kernel gave us root access and accessto a GNU backup server. We reported it to the FSF on May 11, 2026.