http://blog.phusion.nl/2014/09/25/security-advisory-phusion-...
What about the rest of your servers? I can't claim to know that none of mine don't call system() somewhere deep in them.