shell escapes are real attack vector too...