second:
third:
fourth:
"to run arbitrary code really that frequent" define that - any scripting language
with commands like exec(), system() and so on is in danger to run code if it is
not perfectly secured what a default installation is unable to do
and so finally: now, in the past and in any future you have to block any incoming
connection in whatever operating system by default or nobody with security knowledge
will install that "product" because he is aware about the wrong security attitude
of it's creators and that it is not worth the time for a second look