When mainstream media report on security bugs

Every now and then a security bug is discovered in a popular piece of software. Sometimes it's easy to grasp, like a vulnerability in a popular software program, like Microsoft Excel, and sometimes it's a bit harder to grasp. Vulnerabilities in more esoteric software, including protocols and services are high on this list. The most famous example is the hoopla surrounding the Y2K bug, but we need not go further back than the "Heartbleed" bug back in April this year to find examples of egregious reporting and misunderstandings.
The 'bash bug' reported yesterday really brought out some good examples of how tech issues are hard to explain if you don't understand them in the first place. The most interesting example is this story from CNN where you take a basic fact (the discovered vulnerability in bash) and then make up your own story around that. From reading that article, you get the impression that a "smart bulb" can basically destroy your life if hackers start hacking around with it.
First of all, most embedded devices (the 'internet of things') does not include a shell. A "smart bulb" would certainly not, Second, while this vulnerability is certainly serious, the ones who should be concerned about it are sysops running Internet facing services.
I don't know what you can realistically expect from media, but I'd like it if they could dial down the drama, if just a little bit.
Shell Shock
The vulnerability allows remote attackers to execute arbitrary code via a crafted environment because GNU Bash (aka 'bash') processes trailing strings after function definitions in the values of environment variables.
Environment variables were originally designed to hold text. At one point, the developers of Bash wanted to add a feature whereby you could put shell functions into environment variables. The solution was to export an environment variable with the same name as the shell function, whose value would be the code for the shell function wrapped in "() { ... }".
The following function:

master() { echo I am the master; }

will be exported to the environment as a variable named 'master' with the value:

() { echo I am the master; }

If you now type master, bash will print I am the master.
The flaw here is that the Bash developers used their normal command parser to import the function. There's nothing stopping you from defining a function and then doing something else after the function is defined. So you can do this:

master() { echo I am the master; }; echo I am in control

You can concatenate the function definition to something much simpler (but harder to read), like this:

master='() { :;}; echo I am control;'

And then when you run master any code you have added after the function definition is executed.
And that's the problem, because now you're running arbitrary code following the function definition. The function  master() is never executed, so the code inside the braces doesn't matter as long the syntax is valid. Given the right environment, you can use this bug to run any code you want.
A patch is already in the works. If you're running GNU Bash on any of your systems, you need to update as soon as possible. Just don't fear getting hacked through your smart bulb.