Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
    public function cpuUsageLinux(){
        $filePath = ('/proc/stat');
        if ( !@is_readable($filePath)) {
            return 0;
        }
        $stat1  = file($filePath);
        sleep(1);
        $stat2  = file($filePath);
        $info1  = explode(' ', preg_replace('!cpu +!', '', $stat1[0]));
        $info2  = explode(' ', preg_replace('!cpu +!', '', $stat2[0]));
        $total1 = array_sum($info1);
        $total2 = array_sum($info2);
        $time1  = $total1 - $info1[3];
        $time2  = $total2 - $info2[3];
        return round(($time2 - $time1) / ($total2 - $total1), 3);
    }