Two unrelated voice platforms turned out to hand an attacker root the same way. Not a clever exploit, just a single sudoers line letting the web user run an ordinary utility as root with no password. Here is how to find yours.