Woah. This is getting blown a little out of proportion now. It's a bad bug, but we don't need a bunch of misinformation about it: 1. The released patch (and su

Woah. This is getting blown a little out of proportion now. It's a bad bug, but we don't need a bunch of misinformation about it: 1. The released patch (and subsequent update for many distributions) fixed the only currently-known remotely exploitable version of the bug. The cases found afterward are a different bug, and so far there's no publicly known way to remotely exploit it. These other bugs were published to demonstrate that there are deeper flaws in bash's parsing of environment variables. If you have updated bash with the most recent fix, the odds are in your favor that you're going to be just fine. 2. "Routers, web cameras, SIP gateways, NAS’s" & etc. all need to be running a variant of bash to be exploitable. dash doesn't have this problem. ksh, csh, other shells don't have this problem. ash, used by BusyBox, doesn't have this problem. BSD-based systems don't have this problem (except in rare circumstances). 3. DHCP exploitation requires that you have network-start scripts that are run by bash on your system, and you're getting DHCP from a compromised host. 4. Yes, ssh hosts are vulnerable -- if you already have ssh access to those hosts and your shell is bash. This bug doesn't give most users a level of access that they don't already have. But, it can mean that if a user is restricted to specific commands for sudo without being prompted for a password, then they can run arbitrary sudo commands, which isn't very nice. 5. And yeah, mass-scanning started late last night and the first examples of malware using this as a vector are being seen. As scanning techniques improve -- currently they're pretty rudimentary -- more and more hosts will get compromised. Keep calm and update bash.