Hacktron reported that a crafted email address gave any registered GNU Savannah user code execution, enabling the group to gain superuser status and impersonate Bash's maintainer. It said an unpatched kernel yielded root access, and that it could have added a push-capable SSH key to the upstream Bash repository; the FSF was notified on May 11, 2026.