Re: CVE-2014-6271: remote code execution through bash

[Michal Zalewski <lcamtuf () coredump cx>]

Note that on Linux systems where /bin/sh is symlinked to /bin/bash,
any popen() / system() calls from within languages such as PHP would
be of concern due to the ability to control HTTP_* in the env.

/mz