Patch Notes #043 — The Shell Cracked
Five months after Heartbleed, we got the sequel: Shellshock. A bug in bash, the shell, the thing under literally everything, that’s been sitting there for twenty-five years. Environment variables could carry executable functions and bash would just run them. Any CGI script, any DHCP client, boom. The Heartbleed drill kicked in like muscle memory: patch everything, then hunt for the forgotten. This time we had the inventory list (April’s homework paid off), and what took three panicked days in spring took one calm afternoon. I cannot overstate how good that felt. Incident response is a skill you build in peacetime. ...