A typical break-in usually needs some kind of entry ticket – a weak password, a stolen token, or remnants of an old admin panel. But what happens when all it takes to gain access is an ordinary, seemingly legitimate request to a website that makes PHP execute someone else’s code?
