The Hacktron blog documents how
the group was able to compromise the GNU Savannah forge and could have
pushed malware into any of the projects hosted there.

Using Hacktron, we found that an email address like
	`touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any
	registered user code execution on its backend. From there, we made
	our account a superuser, impersonated Bash's maintainer, and
	confirmed we could add an SSH key with push access to the upstream
	Bash repository. An unpatched kernel gave us root access and access
	to a GNU backup server. We reported it to the FSF on May 11, 2026.

https://lwn.net/Articles/1104262/
--- SBBSecho 3.38-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)