01 / Industry under examination

Decades-Old Bash Flaw Enabled Arbitrary Code Execution Across Internet-Facing Systems

      GNU Bash / Shellshock
      1989–2014
      Product Disasters & Recalls
      Archive: verified
      4/5 wildness
    

Shellshock was a family of vulnerabilities in GNU Bash, the command interpreter installed by default on many Linux and Unix-like systems, including macOS. The original flaw was introduced on 5 August 1989 and released in Bash 1.03 on 1 September 1989. Stéphane Chazelas reported it to Bash maintainer Chet Ramey on 12 September 2014; it was publicly disclosed on 24 September as CVE-2014-6271. Bash incorrectly executed commands appended to exported function definitions stored in environment variables, allowing attackers who could control those variables to run arbitrary commands through exposed services such as web servers.

Exploitation began within hours of disclosure. By 25 September, compromised systems were being assembled into botnets for distributed-denial-of-service attacks and vulnerability scanning. Incapsula recorded 17,400 attacks against more than 1,800 domains in one 24-hour period, while Cloudflare reported approximately 1.5 million attacks and probes per day by 30 September. Related flaws—CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187—forced successive patches from Ramey, Red Hat, Canonical, SUSE, and Apple. Reports initially linked a 6 October Yahoo! server compromise to Shellshock, but that specific attribution was denied the following day.

Follow the sources:

Shellshock (software bug) - Wikipedia

← Back to Technology Archive

02 / Daily Briefing

Synchronized UTC selection.
Rotates daily across the archive.

Decades-Old Bash Flaw Enabled Arbitrary Code Execution Across Internet-Facing Systems

Archive Record · 1989–2014

03 / The Archive

687 stories indexed
Filter by sector or keyword.

Product Disasters & Recalls2010s

Cambridge hospital’s £200 million Epic rollout disrupted pathology testing amid wider financial collapse

Epic electronic health record system at Cambridge University Hospitals NHS Foundation Trust

Cambridge University Hospitals introduced Epic as part of its eHospital transformation on 26 October 2014, transferring 2.1 million records in what was described as the first end-to-end Epic deployment in Europe and the first in the UK. The ten-year Epic and Hewlett-Packard infrastructure program was expected to cost about £200 million. In the weeks after launch, pathology codes and reporting failed to match some test results reliably. General practitioners were asked at short notice to stop routine blood tests; some samples were discarded, patients were turned away, and tests had to be repeated. The trust said about 200 patients were affected, while chief information officer Dr Afzal Chaudhry said more than 90% of the implementation had proceeded successfully. The technology problems unfolded alongside a severe operational and financial crisis, rather than being established as its sole cause. The trust spent £13.2 million on agency staff in 2014–15, faced rising treatment waits and as many as 200 beds occupied by patients medically fit for discharge, and projected a £64 million loss for 2015–16. In September 2015, the Care Quality Commission placed it in special measures; chief executive Dr Keith McNeil and the finance director resigned. The trust later recovered a “good” rating and left special measures in January 2017, but in June 2018 it abandoned a £140 million Hewlett Packard Enterprise contract and replaced it with a £107 million Novosco infrastructure, Wi-Fi and cybersecurity deal.

Archive: verified ↗

Product Disasters & Recalls1980s

Morton Thiokol Overruled Engineer’s Cold-Weather Warning Before Challenger Explosion

Space Shuttle Challenger, Morton Thiokol solid rocket boosters, Roger Boisjoly

Morton Thiokol engineer Roger Boisjoly warned repeatedly that the Space Shuttle’s solid rocket booster O-rings could fail in cold weather. After examining a January 1985 booster, he found that one O-ring had failed and the second had been damaged. In a July 1985 memo, Boisjoly described the joint-seal design as a potentially catastrophic safety problem: booster-joint flexing could delay the O-rings’ movement into a sealing position, allowing hot gas to escape. Cold temperatures made the rubber less flexible and increased the risk of blow-by. By late 1985, he told managers that an unfixed defect could destroy a shuttle mission. For the STS-51-L launch scheduled for January 28, 1986, overnight temperatures were forecast to fall to about −1 °C (30 °F), and Morton Thiokol engineers recommended delaying the flight during a NASA go/no-go conference. NASA officials challenged the recommendation; managers then reconvened without Boisjoly and the engineering team and reversed the company’s position, telling NASA that the data was inconclusive. Challenger launched at 11:38 a.m. on January 28. At 58 seconds, a damaged O-ring seal failed in high-altitude winds; at about 73 seconds, escaping hot gas weakened the external tank and the vehicle disintegrated, killing all seven crew members. The presidential commission ordered by President Ronald Reagan examined the decision-making process, while Boisjoly testified that the reversal reflected customer intimidation and an unethical management forum. He was later ostracized and reassigned, but received the AAAS Award for Scientific Freedom and Responsibility in 1988; his records were donated to Chapman University in 2010.

Archive: verified ↗

Product Disasters & Recalls1970s–2010s

GE Engineers Warned in 1976 That Nuclear Reactor Designs Could Fail Under Accident Conditions

General Electric Mark 1 nuclear reactor

On February 2, 1976, General Electric nuclear engineers Gregory C. Minor, Richard B. Hubbard, and Dale G. Bridenbaugh resigned from responsible positions in GE’s nuclear energy division and publicly disclosed safety concerns about U.S. nuclear power plants. Their statements attracted journalists and the anti-nuclear movement, and helped prompt congressional hearings. The three later formed MHB Technical Associates, advising state governments, federal agencies, and foreign governments on nuclear-industry risks. The source does not identify a GE executive as responsible or provide a financial figure connected to the disclosures. The engineers returned to public attention after the March 2011 Tōhoku earthquake and tsunami led to explosions and containment failures at Japan’s Fukushima Daiichi plant. Five of Fukushima’s six reactors used GE Mark 1 designs. Bridenbaugh argued that the design did not adequately account for dynamic loads during a loss-of-coolant accident and remained more susceptible to a loss of containment despite retrofits. MHB also served as a technical adviser for The China Syndrome, linking the whistleblowers’ warnings to later public debate over reactor safety. The lasting consequence was renewed scrutiny of the Mark 1 design and the adequacy of nuclear-regulatory safeguards.

Archive: verified ↗

Product Disasters & Recalls2000s

FDA Safety Official Warned the Agency Was “Virtually Defenseless” Against Another Vioxx

FDA drug-safety system; Vioxx (rofecoxib); Merck

On November 18, 2004, FDA Associate Director David J. Graham testified before the U.S. Senate Committee on Finance after Merck withdrew the anti-inflammatory drug Vioxx the previous month because of serious safety concerns. Graham said FDA policies were inadequate to protect the public from drugs with unacceptable risks, declaring that the agency was “incapable of protecting America against another Vioxx” and that the public was “virtually defenseless.” His testimony placed the regulator’s post-approval drug-surveillance system, rather than only Merck’s withdrawal decision, under scrutiny. The FDA publicly criticized Graham after his testimony. He then sought advice from the Government Accountability Project, a nonprofit whistleblower-protection organization, to publish his Vioxx findings over objections from his superiors. In a 2005 interview, Graham alleged that FDA was institutionally biased toward pharmaceutical companies and treated industry as its client, prioritizing approvals over safety or medical necessity. His broader record included work associated with removing or restricting drugs such as Rezulin, Fen-Phen, Redux, Trovan, Lotronex, Baycol, Seldane, and Propulsid. In 2010, Graham and FDA colleague Kate Gelperin also urged withdrawal of Avandia, citing possible increased mortality, though their findings differed from other published studies.

Archive: verified ↗

Product Disasters & Recalls2010s

Trinity’s undisclosed guardrail redesign triggered a whistleblower suit and federal safety review

Trinity Industries ET-Plus end terminal

Joshua Harman, co-founder of guardrail manufacturer SPIG Industry, investigated Trinity Industries’ ET-Plus highway end terminal during a 2011 patent dispute. Harman alleged that Trinity had introduced five undisclosed design changes beginning in 2005, including narrowing the guide channel from five inches to four. He argued that the altered terminal could lock during a crash instead of allowing the guardrail to slide and absorb energy, potentially driving the rail into vehicles. Harman documented more than 40 deaths and 100 injuries that he associated with redesigned terminals, though those incident connections were part of his investigation and allegations rather than a universal official finding. In 2012, Harman filed a False Claims Act qui tam action alleging that Trinity obtained federal reimbursement eligibility without disclosing the modifications. A federal jury in October 2014 found Trinity liable for $175 million, and in June 2015 the court trebled damages to $663 million; Harman received roughly $199 million plus $19 million in fees. The U.S. Court of Appeals for the Fifth Circuit reversed in October 2017, holding that the omissions were not material because the Federal Highway Administration had continued treating the product as eligible. Separately, the ET-Plus lost federal-aid reimbursement eligibility on December 31, 2017, after failing updated MASH safety criteria, and Trinity later divested its highway-products business in 2021.

Archive: verified ↗

Product Disasters & Recalls2005–2009

German Constitutional Court Rejected Secretive NEDAP Voting Machines as Unverifiable

NEDAP ES3B electronic voting machines; Chaos Computer Club; Wau Holland Foundation

During Germany’s 18 September 2005 federal election, NEDAP ES3B direct-recording electronic voting machines were used in roughly 2,000 voting districts, allowing an estimated 2–2.5 million voters to cast ballots through the devices. The Wau Holland Foundation and Chaos Computer Club supported an investigation by security researchers Rop Gonggrijp and Willem-Jan Hengeveld, whose report argued that the machines required the public to place “ultimate trust” in their software because they produced official results that could not be independently verified. The researchers said the weakness arose from the machines’ fundamental design, not from an easily repairable defect. The campaign raised a serious democratic accountability problem, but the source does not establish that any election result was actually manipulated. Many of the machines were subsequently decertified. On 3 March 2009, Germany’s Federal Constitutional Court ruled that the Federal Electoral Equipment Ordinance governing electronic voting was unconstitutional because ordinary citizens could not understand or publicly scrutinize the vote-counting process without specialist knowledge. The court did not permanently prohibit electronic voting: it left open future use if authorities could guarantee reliable, constitutionally adequate accuracy controls. The ruling made transparency and independently verifiable results legal requirements for election technology in Germany.

Archive: verified ↗

04 / Integration & SDK

Integrate Darkside into your app.

Deploy embeddable web components or consume JSON APIs to power research portals, terminal widgets, and editorial sidebars.

Daily Briefing Web Component

<script src="https://darkside.wiki/daily-technology-widget.js" async></script>
<darkside-daily-technology></darkside-daily-technology>

Custom Embed Options

<script src="https://darkside.wiki/technology-widget.js" async></script>
<darkside-technology-widget data-category="Surveillance & Privacy"></darkside-technology-widget>

REST API Endpoint

GET https://darkside.wiki/api/technology/facts?category=Monopoly+%26+Antitrust&limit=10
GET https://darkside.wiki/api/technology/widget/daily