the gaping security holes in phpnuke and postnuke cease to amaze me. these things are the slash 1.x (or bugzilla) of the php world -- everyone loves them, but they are pretty dismal examples of programming.