A 2026 cheatsheet on command injection frames CWE-78 as a hands-on problem of OS payloads, unsafe command construction, and defensive design.