(May 2026) TL;DR: an email address like atouch${IFS}/tmp/[email protected] gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root... Weiterlesen: Securing Internet-Critical Software: How We Could Have Backdoored Bash
Intelligence View
⚡ tsecurity.de Intelligence
Securing Internet-Critical Software: How We Could Have Backdoored Bash
(May 2026) TL;DR: an email address like atouch${IFS}/tmp/[email protected] gave any registered user code execution on its backend. From there,…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes · Konfidenz 86%
Skanuj publicznie dostępne usługi za pomocą OpenVAS, naostrz zasady WAF, skróć okna łat.
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest - bezpłatnie Codziennie najważniejsze wiadomości bezpieczeństwa · można pobrać w każdej chwili
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Brak recenzji czytelników
Czy ta strona była pomocna?
0
Powered by tsecurity.de
tsecurity.de Hub
Powiązany klaster opowieści i źródła (wektor AI)
9 źródeł
The Apple Watch Ultra 4 just hit its lowest price ever ahead of Black Friday
8 kolejnych źródeł
ZZDNETvor 1 Std.The Apple Watch Ultra 4 just hit its lowest price ever ahead of Black Friday TTechRepublicvor 4 TagenApple Touchscreen MacBook Pro Cheat Sheet: Price, Specs, and More TThe Vergevor 2 Std.The Apple Watch Ultra 4 is $100 off, matching its best price to date ZZDNETvor 1 Std.The Apple Watch Ultra 4 just hit its lowest price ever ahead of Black Friday ZZDNETvor 1 Std.The Apple Watch Ultra 4 just hit its lowest price ever ahead of Black Friday ZZDNETvor 4 Std.Apple’s HomeView may double as security camera – watch out Ring, Nest, and Wyze
+2
9 źródeł
CVE-2026-53613 | Linux util-linux mount toctou (Nessus ID 374940)
8 kolejnych źródeł
VVulDB Updatesvor 4 Std.CVE-2026-53612 | Linux util-linux Mount mount toctou (Nessus ID 374940) VVulDB Updatesvor 4 Std.CVE-2026-53614 | Linux util-linux mount privileges management (Nessus ID 374940) VVulDB Updatesvor 3 Std.CVE-2026-99239 | Linux Kernel up to 7.3.0 L2CAP __l2cap_chan_add toctou (EUVD-2026-115281) VVulDB Updatesvor 2 Std.CVE-2026-53615 | util-linux up to 2.41.3 libblkid dos.c parse_dos_extended integer overflow (Nessus ID 374940) VVulDB Updatesvor 2 Std.CVE-2026-72083 | Linux Kernel up to 7.2-rc3 SCSI Target Core core_scsi3_emulate_pro_register_and_move use after free (Nessus ID 374938) VVulDB Updatesvor 2 Std.CVE-2026-74283 | Linux Kernel up to 7.1.4 tipc netlink_net_capable permission (Nessus ID 374938)
+2
8 źródeł
CVE-2026-99241 | Linux Kernel up to 7.2.13 NTFS ntfs_filemap_page_mkwrite race condition (EUVD-2026-115283)
7 kolejnych źródeł
VVulDB Updatesvor 3 Std.CVE-2026-99240 | Linux Kernel up to 6.18.59/7.2.13/7.3.0 Damon Core mm/damon/core.c damos_commit_quota_goal target_value divide by zero (EUVD-2026-115282) VVulDB Updatesvor 3 Std.CVE-2026-99237 | Linux Kernel up to 6.18.59/7.2.13/7.3.0 tracing update_last_data_if_empty race condition (EUVD-2026-115279) VVulDB Updatesvor 3 Std.CVE-2026-99238 | Linux Kernel up to 6.18.59/7.2.13/7.3.0 Tracing trace_module_record locking (EUVD-2026-115280) VVulDB Updatesvor 3 Std.CVE-2026-99235 | Linux Kernel up to 7.3.0 Tracing event_hist_trigger_free use after free (EUVD-2026-115277) VVulDB Updatesvor 3 Std.CVE-2026-99236 | Linux Kernel up to 7.3.0 tracing predicate_parse out-of-bounds (EUVD-2026-115278) VVulDB Updatesvor 3 Std.CVE-2026-99233 | Linux Kernel up to 7.3.0 Histograms event_hist_trigger_parse/hist_unreg_all event_call/ref use after free (EUVD-2026-115275)
+1
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/pl/4310779/linux-porady-i-hardening/securing-internet-critical-software-how-we-could-have-backdoored-bash/