Web attacks build on Shellshock bug