Pro PHP Security: From Application Security Principles to the Implementation of XSS Defenses, Second Edition

Dangerous Operations

In this section, we discuss two different categories of potentially dangerous operations: commands that must be run as root, and operations that require an unusual amount of CPU time or bandwidth. These are things that unprivileged users such as the webserver's nobody should not be allowed to do. They are dangerous for different reasons, but the common thread is that you would not want any of them to be abused by someone who has access to your online applications.

Root-level Commands

One category of dangerous operation is the set of commands that reach so deeply into your system's resources that they must be carried out by a user with high privileges, like a member of the wheel or admin groups, or even the root user itself. ...