GNU Savannah Patched After Reported Vulnerabilities Triggered Service Disruption

GNU Savannah, the software forge and hosting platform used by GNU and other free software projects, suffered a security incident that disrupted services and forced administrators to take systems offline while recovery work proceeded. The Free Software Foundation said security researchers from Hacktron had reported vulnerabilities in early May and demonstrated an exploit, after which FSF, GNU, and volunteer staff patched all reported issues along with additional security problems submitted during the review.

FSF said its investigation found no evidence that sensitive project data or credentials were accessed and no indication that Savannah’s software supply chain was compromised. Service was later restored in stages, with some functions remaining limited during recovery, and FSF said it would take additional precautionary steps, notify Savannah-hosted projects and other Savane operators, and publish a fuller incident report within 30 days.