>  includes any PHP, Ruby or Python site that allows
  >  shell commands to be executed

So any site already vulnerable to arbitrary command execution will now be vulnerable to RCE via arbitrary command execution? If your site currently allows arbitrary shell command execution the game was already lost.

  >  It has all the potential to be huge. 

Really? The vulnerability on the client side is limited to a very small percentage of the internet users. Furthermore these users are much more likely to be aware of the vulnerability and upgrade compared to grandma and her flash plugin. The story is not that different on the server. The number of publicly accessible git daemons pales in comparison to apache or services that use openssl. As mentioned above this does not really change anything for sites that allow arbitrary shell command execution.

Running around like chicken little saying the sky is going to potentially fall is not productive and in the long run will probably not bring about the desired result for your page views...

At GitLab this was fixed with https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3240 which we plan to release tomorrow in 8.5.7 https://gitlab.com/gitlab-org/gitlab-ce/issues/14308

But a fix should come via the normal update channel soon? I'm on wily, should I expect to add this PPA or risk vulnerability?

Yes, pijul: https://pijul.org/

Almost certainly.

Which reminds me of a (partial) Haskell git implementation: http://stefan.saasen.me/articles/git-clone-in-haskell-from-t...

Previously posted to HN a number times, e.g. https://news.ycombinator.com/item?id=8713328

It wouldn't have to be a new DVCS. It could be a Rust implementation of Git. e.g. Java Git implementation (JGit) used by Eclipse, Gerrit, etc.

For sure a big deal, we're deploying GitLab.com as we speak https://twitter.com/gitlabstatus/status/709888872549847040

Remote code execution is worse than Heartbleed.