As David mentioned in the PEAR Blog yesterday, in the PEAR Security Advisory PSA 200911-14-01, Net_Ping and Net_Traceroute had been found to have command injection venerabilities in them.
These were fixed and new versions released immediately – further details are available on the Official PEAR Blog.