ALT-15 · Paper · 23 Oct 2026
Shellshock: twenty-five years inside Bash
A parsing bug in how Bash imported functions from environment variables turned web servers, DHCP clients and routers into remote shells. A short history of a long-lived bug.
- 1989Function export through environment variables appears in Bash.
- 24 Sep 2014Disclosed as CVE-2014-6271; the first patch is incomplete.
- Following daysRelated flaws (CVE-2014-7169 and others) are found as researchers look closer; patches follow.
How it worked
A variable such as x='() { :;}; echo pwned' looked to Bash like an exported function. Bash defined the function — and then ran the trailing command. Web servers using CGI copied HTTP headers like User-Agent into environment variables, so a single request could run a command on the server.
Why it mattered
The flaw sat underneath countless systems that did not know they used Bash at all: CGI scripts, DHCP clients, embedded devices. Scanning for it started within hours of disclosure.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Features that turn data into code are the most dangerous ones a program can have.
- The first patch for a famous bug is rarely the last; expect follow-ups and keep patching.
- Old code is not proven code — it is code nobody has looked at recently.
What it means for you
- Never pass untrusted input into environment variables of a process that starts a shell.
- Prefer
exec-style process creation with argument arrays over shell strings. - Inventory embedded and legacy devices; they are where such bugs live longest.
Sources
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-15 — Shellshock: twenty-five years inside Bash. 23 Oct 2026. altumptic.com/research/shellshock-2014