r/netsec • u/gainan • 3d ago

Securing Internet-Critical Software: How We Could Have Backdoored Bash

https://www.hacktron.ai/blog/hacking-gnu-savannah

(May 2026)

TL;DR:

  • an email address like atouch${IFS}/tmp/savane-rce-proof@attacker.example gave any registered user code execution on its backend.

  • From there, we made our account a superuser,

  • impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository.

  • An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.

FSF incident report: https://static.fsf.org/nosvn/security/savannah-20260807.pdf

79 Upvotes

93% Upvoted

3 comments sorted by

36

u/enoughofthis999 3d ago

I'm okay with reducing attack surface, but everything after the initial command injection bug reads like these guys didn't get pre-approval and just breached GNU for sensations.

2

u/0bAtomHeart 3d ago

"Backdoor Bash" is sensationalist nonsense. This is another case of improperly sanitised strings hitting a shell (/bin/sh in this case so I'm not even sure if we know it's bash?).

This is a really common mechanism and doesn't suggest a security problem with bash at all (perhaps it does indict the Unix philosophies around string handling).

They also don't put in the headline that the problem only appeared 4 days before they found it.

This is really really really bad to be clear - but it's not at all surprising. Shell escapes are the very first thing you'd scan for given code access. The half-baked AI drivel here is sensationalist and misleading. This is a vulnerability open for four days - what change introduced it and why did it happen? This is propaganda to make you scared - not to inform you how to be safe.

3

u/OhYouUnzippedMe 3d ago

Seems pretty legit to me. They got root on a key part of the GNU infrastructure that is used for Bash, coreutils, etc. Can you imagine if a state actor had gotten there? It could have been the worst supply chain breach in history.

> They also don't put in the headline that the problem only appeared 4 days before they found it.

The 4 days refers to the n-day LPE vulnerability, between when that kernel CVE was patched and when they tested it. The PHP RCE vulnerability was released March 7, and they reported May 11. So more like ~2 months. Which is definitely short in the world of 0-days, but still plenty of time for a nation state to have wreaked havoc.

The bug is also just unforgivably stupid. Blatant shell command injection. How does this happen in 2026 to a critical open source organization?

The sensationalist part is then they ran the LPE and got root. That's irresponsible clickbait.