> is there really any point in worrying about library security when the $PATH has been effectively hijacked? Well, there might be legitimate (although somewhat

> is there really any point in worrying about library security when the $PATH has been effectively hijacked? Well, there might be legitimate (although somewhat misguided) reasons for someone to do that. People routinely do similar things in dev environments all the time. I can absolutely see how it could reach production. If you don't expect your web app to launch shell scripts you might not even think about it. It's the small things, which in themselves might not be serious or even noteworthy, which compound together to deliver the nasty surprises.