A tale of several hijacks and what it taught me about runtime-driven testing

What do the Windows versions of Ghostscript, Apache, PHP, GnuPG, wget, and Microsoft Coreutils have in common?

This article walks through a series of recently discovered file-hijacking issues in widely used software. I break down the root causes: default OS permissions on common filesystem locations, code poorly ported from other platforms, assumptions that don’t hold, insecure or missing installers, and various path construction issues such as failed environmental variable expansion or mismatches between APIs.

I also ask why these issues slip past static source-code analysis — looking at the practical differences between source, the compiled executable, and the running process—and how runtime-driven testing helps close that gap. All in a story that started with a simple follow-up investigation.

Read the full research here.

Table of Contents
1  Introduction 3
2  Case studies 3
2.1  Ghostscript (CVE-2026-19547) 3
2.2  Apache HTTP Server (CVE-2026-89281) 4
2.3  PHP default include_path. 6
2.4  GnuPG. 12
2.5  wget (CVE-2026-94574) 12
2.6  Microsoft Core Utils tail.exe. 14
2.7  Undisclosed software product #1. 16
2.8  Undisclosed software product #2. 17
3  Cause and exploitability analysis 18
3.1  Exploitability root cause. 18
3.1.1  The C:\ root directory. 18
3.1.2  C:\ProgramData. 18
3.1.3  C:\Windows\TEMP. 19
3.2  Existence root cause #1 – Unix paths ported to Windows. 19
3.3  Existence root cause #2 – default paths. 20
3.4  Existence root cause #3 – insecure installers. 21
3.5  Existence root cause #4 – path construction failures. 21
4  Source code != binary, binary != process 22
5  Conclusion. 23