To be honest, I don't know what the author means; but I've seen web exploits using /dev/shm as alternative location to dump scripts (the other usual suspects are /tmp and /var/tmp). The web server process can write there, spawn a new process, etc.
I think it's better to protect the entry point (ie. in PHP, use php.ini open_basedir).
I could see making all writable filesystems noexec - _that_ would make sense. Making all of /dev/shm read-only, and thus breaking the POSIX shared memory API? Madness.
I think it's better to protect the entry point (ie. in PHP, use php.ini open_basedir).