Hacktron said it found a flaw in GNU Savannah, the site that hosts Bash and Coreutils. Its researchers registered with an email address containing a shell command in backticks, and the site ran it. Hacktron said this let them read the database login, make their own account a superuser, and sign in as Bash maintainer Chet Ramey. His page would have let them add an SSH key (a login credential) with push rights to Bash. They said they did not add one or touch the repository.
Hacktron said a public exploit for a 2023 kernel bug then gave it root access on the server and a key to a backup host. After that it wrote its report and sent it to the FSF on May 11, 2026. Hacktron reported 26 confirmed vulnerabilities in total, which the FSF fixed. The FSF traced the first bug to a March 7, 2026 release. iTnews reported that the FSF found no reason to believe project data or credentials were accessed.
The weak link was not Bash's code but a site feature that passed user input to a shell. iTnews noted that Ramey signs Bash releases, so a planted change would probably have had to get past him first. Buyers can ask three things: who can add push keys to the code they rely on, whether releases are checked against signatures, and how fast suppliers patch.