> They're such different bugs that they're hard to compare. I mentioned it because people are having a field day comparing the two (which results in some good

> They're such different bugs that they're hard to compare. I mentioned it because people are having a field day comparing the two (which results in some good old fashioned fear mongering). A random sampling: CNet: ​'Bigger than Heartbleed' Gizmodo: Why the Bash Shellshock Bug Could Be Even Worse Than Heartbleed Mashable: Shellshock: The 'Bash Bug' That Could Be Worse Than Heartbleed The Independent: Shellshock: Bash bug 'bigger than Heartbleed' could undermine security of millions of websites Errata Security: Bash bug as big as Heartbleed > The CGI doesn't have to be written in bash This was covered in my second item, about using system(). I'm certain that there is software out there that does this, but it is in no way common or has ever been best practice. The panic over this presumes that people use CGI all the time. It's awful, it's always been awful, and should never be used for anything public facing for lots of other reasons. Note that FastCGI is not impacted. > If you're on a network with nodes you don't trust Correct, but this isn't the case for most (but not all) server deployments. In your own datacenter environment, you control the network and all of the hosts on it -- if someone busts in to run a DHCP server, you have bigger fish to fry.