> Why not just have php.exe call the cmd.exe in the system process?

from what i think i understand you're saying here, it does. Remember, php.exe is not a user. nor indeed is IIS. Both run under the user of IUSR_*. This is inbuilt microsoft security, and to be honest, trying to work around that would be a: one hell of a hack, and b: much less secure.

we don't want to be adding security holes here.

and as far as your nimda reference goes -- have you noticed that nimda et al all require a script on the webserver to exploit?

the reason this hasn't happened with php (yet) is because we don't distribute too many scripts with our binary. So, there is no guarantee of the existance of a script, like there is with IIS's install layout.

i understand how you would feel this is a bug, but realisitically, for the most safety we have to build PHP as an unprivileged binary. Anymore, and it would be too  dangerous to even consider using php -- or any other scripting engine, for that matter.