lorax - 1:28 pm on Nov 4, 2013 (gmt 0)
As long as the files have execute permission they can call and run other files. Nothing nefarious about it in itself as this is common practice with applications. It's when a malicious script is uploaded to your server and executed that the troubles begin. That's why that first layer of security is all important as is subsequent monitoring of files and activity on the server.