How We Could Have Backdoored Bash (Hacktron blog)

Hacktron says a shell injection in the email field of Savane, the software behind GNU Savannah, let any registered user run code on the server. It reports escalating to superuser, confirming it could add an SSH key with push access to Bash's upstream repository, and reaching root and a backup server through an unpatched kernel. After a May 11, 2026 report, it found 25 more flaws; the FSF fixed all 26. The account is Hacktron's own. It shows how one input-validation flaw can reach source repositories.