> TL;DR: GNU Savannah hosts Bash, Coreutils, and hundreds of other GNU projects. Using Hacktron, we found that an email address like a`touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.
> Savannah runs Savane, a PHP application that is itself free software, so we pointed Hacktron at the source and audited it.
Imagine attackers reading that and ordering swarms of abliterated frontier models onto an open source project like that.
Many projects like the FSF do not use AI themselves maybe "by principle", but the attackers don't care and will unleash AI agents on to anyone as a backdoor target.
Given all that you have seen with the mass discovery of these security issues and hacks, there will be no choice from open source projects to conglomerates to use AI to protect themselves ahead of the attackers.
rvz•55m ago
> TL;DR: GNU Savannah hosts Bash, Coreutils, and hundreds of other GNU projects. Using Hacktron, we found that an email address like a`touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.
> Savannah runs Savane, a PHP application that is itself free software, so we pointed Hacktron at the source and audited it.
Imagine attackers reading that and ordering swarms of abliterated frontier models onto an open source project like that.
Many projects like the FSF do not use AI themselves maybe "by principle", but the attackers don't care and will unleash AI agents on to anyone as a backdoor target.
Given all that you have seen with the mass discovery of these security issues and hacks, there will be no choice from open source projects to conglomerates to use AI to protect themselves ahead of the attackers.