“Savannah’s Git hosting is keyed off these entries, so adding a key here grants push access to bash.git as the maintainer.”
One email address with shell metacharacters gave any registered user code execution on the forge that hosts Bash and Coreutils. From there it was superuser, then impersonating Bash’s maintainer, then one form away from push access. Hacktron sells pentesting, so this is an ad. It’s a good ad, because the 26 confirmed flaws were real and the software underneath everything was sitting behind them.