‘Shellshock’ Bug Spells Trouble for Web Security
Summary: Security experts warned in September 2014 that attackers were exploiting a critical flaw in the GNU Bourne Again Shell (Bash) on Linux and Unix systems, dubbed "Shellshock," which could expose millions of networks and consumer records. AlienVault labs director Jaime Blasco reported his honeypot found two worms actively exploiting the vulnerability to install malware that turns systems into bots connecting to a command-and-control server for distributed denial-of-service attacks.
Key Takeaway: The official patch was reported incomplete, and researcher Nicholas Weaver noted the flaw would persist in embedded systems that won't be updated for a long time - while a scanner could sweep every website on the planet for vulnerable pages.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026