Here's an example from Wordpress: if (!@$mail = popen($sendmail, 'w')) { Here's another example from Active Record: Kernel.system("psql -q -f #{Shellwo

Here's an example from Wordpress: if (!@$mail = popen($sendmail, 'w')) { Here's another example from Active Record: Kernel.system("psql -q -f #{Shellwords.escape(filename)} #{configuration['database']}") This is not uncommon, and your web app probably do it if you send mail or interact with other services on the machine. There are quite a few examples in most frameworks, are you completely sure nothing you depend on calls popen? Far safer just to update bash.