Eighteen years ago my university let me host PHP scripts in a /~user directory, and I wrote my own simple blogging software and ran it there.
It was vulnerable to the attacks described here. Thankfully no-one on that domain ever exploited it in that way.