the files are 777 and I am root?
the files are too powerful and PHP is nobody.
I'd say chmod those puppies to 755 and chown/chgrp nobody.
PHP will be able to read/write and exec, but no one else.
But what really bothers me here is the concept of a shell script that is updated via a web browser interface...
Sounds like your just inviting people to come on in and write their own hacks on your server.
Also to exec, you need to handle it like a script, it's not a binary ya know.
<? exec("./myfile.php"); ?>