Usually poor ops hygiene, same really as PHP problems: * Code runs as web server user * Code is deployed as web server user, because web monkey doesn't underst

Usually poor ops hygiene, same really as PHP problems: * Code runs as web server user * Code is deployed as web server user, because web monkey doesn't understand unix permission (or alternatively chmod 777 everything for same effect) * Code gets hacked, attacker can modify any file so they just leave backdoor in code If you deploy code as different user attacker can still of course steal all the data but at the very least they can't modify the code that is running. On top of that, a lot of poor security practices when it comes to qouting stuff. Perl had kinda interesting feature regarding that where in special mode (recommended for apps dealing with untrusted inputs) the variable was considered tainted [1] till something "cleaned" it by passing it thru regexp. So say taking argument directly from environment (so headers for web) or stdin and passing it with no processing to system() would trigger it. * [1] https://perldoc.perl.org/perlsec https://perldoc.perl.org/perlsec