Technology

Shellshock

Critical 2014 GNU Bash code-injection vulnerability, CVE-2014-6271.

Twelve years after it was disclosed, a Shellshock variant, CVE-2014-6278, appeared in joint advisory AA26-281A on 8 October 2026 among the flaws used by actors tied to Beijing's Integrity Technology Group.

Last refreshed: 12 October 2026

Key Question

Why does a 2014 Bash bug still appear in 2026 hacking advisories?

Timeline for Shellshock

#14 8 Oct

Mentioned in: Ten agencies name Beijing firm in hacks

Cybersecurity: Threats and Defences

View full timeline →

Background

Shellshock, also called Bashdoor, is a family of flaws disclosed in 2014 in the GNU Bash Shell, beginning with CVE-2014-6271. CISA alert TA14-268A set out the mechanism: Bash up to version 4.3 executes commands that trail a function definition stored in an environment variable. A remote attacker can therefore run code through routes such as CGI scripts on web servers.

CISA put CVE-2014-6271 on its Known Exploited Vulnerabilities catalogue in January 2022, and added the related CVE-2014-6278 in October 2025. On 8 October 2026 joint advisory AA26-281A named CVE-2014-6278 among the flaws exploited by actors connected to Integrity Technology Group.

Shellshock's return in a 2026 advisory shows how long unpatched appliances stay reachable on the internet.

Common Questions

What is Shellshock?

A 2014 family of GNU Bash flaws, starting with CVE-2014-6271, that let remote attackers run code through environment variables.Source: CISA alert TA14-268A

Which Bash versions are affected by Shellshock?

CISA said GNU Bash through version 4.3 is affected.Source: CISA alert TA14-268A

Is Shellshock still exploited?

Yes. Advisory AA26-281A of October 2026 listed Shellshock variant CVE-2014-6278 among flaws used in Chinese-linked intrusions.Source: CISA advisory AA26-281A