Cyber ·
Hacktron reports compromise of GNU Savannah forge and risk to Bash repository
Hacktron describes how a research group compromised the GNU Savannah forge and states it could have obtained push access to the upstream Bash repository. The finding was reported to the FSF on May 11, 2026.
According to the Hacktron blog, republished in the LWN feed in machine translation, the group compromised GNU Savannah, a forge hosting free software projects. The researchers report that a malformed e-mail address field allowed any registered user to execute code on the backend. From there, they elevated their account to superuser, impersonated the Bash maintainer, and confirmed they could add an SSH key with push access to the upstream Bash repository. An unpatched kernel reportedly gave root access and access to a GNU backup server.
The text states the group reported the problem to the FSF on May 11, 2026, and the original post is dated October 31, 2026. The account describes what could have happened, not an actual attack on the upstream Bash project. For the current state of fixes, consult the FSF official advisory and the original Hacktron blog through the public channels indicated in the feed.
Original source: Como poderíamos ter inserido uma backdoor no Bash (blog da Hacktron)