A tale of several hijacks and what it taught me about runtime-driven testing

What do the Windows versions of Ghostscript, Apache, PHP, GnuPG, wget, and Microsoft Coreutils have in common?

This article walks through a series of recently discovered file-hijacking issues in widely used software. I break down the root causes: default OS permissions on common filesystem locations, code poorly ported from other platforms, assumptions that don’t hold, insecure or missing installers, and various path construction issues such as failed environmental variable expansion or mismatches between APIs.

I also ask why these issues slip past static source-code analysis — looking at the practical differences between source, the compiled executable, and the running process—and how runtime-driven testing helps close that gap. All in a story that started with a simple follow-up investigation.

Read the full research here.