See Q124:

offset is defined as required int in
https://we.phorge.it/source/phorge/browse/master/src/applications/diffusion/conduit/DiffusionHistoryQueryConduitAPIMethod.php$27

But there's no validation that it's actually an integer (or even provided) anywhere.

In theory, this sort of thing can lead to remote-execution, but I'm hoping the auto-quoting of the exec family handles that.

The actual validation should happen on the arguments.