I see your point with the first bit. System A passes safely to System B, B passes safely to C, etc. The problem, as you note, is that in order to correctly im

I see your point with the first bit. System A passes safely to System B, B passes safely to C, etc. The problem, as you note, is that in order to correctly implement the CGI standard, Apache must pass the problematic data. Even if it took care to see "I'm about to pass this to bash, which might do something stupid with it, so I'll fix that", it can't know that a non-bash CGI executable is going to pass it to bash somewhere down the line. I agree with your other conclusions. People will definitely be re-evaluating shells, CGI, and environment variables for at least a few months or so while this is fresh.