Mailing the story:

People have been warning new programmers about backticks for years; do a Google search for "shell security backticks" and you'll see what I mean. This is basic level stuff, and it is beyond incredible that it bit these guys. I would like to charitably assume that this was just an error of sloppiness; because it was "just a shell script" programmers who darn well do know better just didn't look very closely. But it's still disturbing, isn't it?