Five months after Heartbleed, we got the sequel: Shellshock. A bug in bash, the shell, the thing under literally everything, that’s been sitting there for twenty-five years. Environment variables could carry executable functions and bash would just run them. Any CGI script, any DHCP client, boom.
The Heartbleed drill kicked in like muscle memory: patch everything, then hunt for the forgotten. This time we had the inventory list (April’s homework paid off), and what took three panicked days in spring took one calm afternoon. I cannot overstate how good that felt. Incident response is a skill you build in peacetime.
The bigger lesson everyone’s writing about: this is the second ancient, universal, volunteer-maintained thing to catch fire this year. The internet is a cathedral built on load-bearing hobby projects. The Core Infrastructure money is starting to flow but the audit backlog is generations deep.
EPL is in full swing. Liverpool, who haven’t won the league in 24 years, are struggling to repeat last season’s run after selling Suarez. Football plus incident response: my cortisol is fully subscribed.
TIL: env x='() { :;}; echo vulnerable' bash -c "echo test", the one-liner that tells you if you’re exposed. A whole CVE that fits in a tweet.