This is probably fairly well known, I found it by accident while reading about the 0xFF command sperator in older version of bash shell. The newer phf cgi that comes with some versions of picasso and rembrant have been patched for the obvious 0x0A newline escape, but can still be escaped using 0xFF. It takes vulnerabilites in both phf and bash for it to work. I have tested this very successfully on many linux machines. I would imagine that most people are aware of the 0x0A escape and so when they test it on their own box they think they are safe from phf exploitation. The syntax for the exploit is almost identical to the older phf exploit. To execute commands: (cat /etc/passwd) http://server.net/cgi-bin/phf?Qalias=%ffcat%20/etc/passwd I know this exploit isn''t only confided to linux, but it seems its easiest to exploit on linux. If everybody is aware of this, excuse me. It''s just that I dont think enough admins are aware of this, and they are leaving their networks very open for exploitation. Zeed [mod: Yes this is old, boring stuff. The "new" thing in this post is that there are still lots of sites vulnerable to this attack. Welllll, maybe that''s no news either. Maybe I was too lasy to write a rejection notice -- REW :-] (DY)