Hacker News Reader

Note that this is only true if your host is running PHP using mod_php or similar, and they don't have safe_mode configured properly.

A perl script running via cgi could do it, no?

Unless your host is incredibly dumb and doesn't have suexec enabled [1], CGI scripts run as their owner [2].

[1] And, if they don't, you should run away. Fast.

[2] The actual rules are a little more complex than that, but that's what it comes down to.