Hi Alex,
The article
http://www.vox.com/2014/9/25/6843949/the-bash-bug-explained
explains the shellshock bug pretty plainly. It seems the shellshock bug allows commands to be passed when environment variables are set in bash.
Personally, I know neither how much WeBWorK uses bash to set environment variables, nor how the shellshock bug is fixed. My guess is that the WeBWorK code never passes a command when environment variables are set in bash, and that the shellshock bug fix will not cause any problems. But, that is just a guess based on speculation, not examining the code (so it may be incorrect). I hope this helps.
Best regards,
Paul Pearson
We updated our ubuntu 14.04 server with no ill effects that we can see. Webwork seems to be running fine.
And if two stories will eventually turn into data :), we performed the same Ubuntu 14.04 security update, and Webwork seems to be working normally for us as well.