As for what to do about AUTOLOAD ... well, that depends entirely upon your application.   Generally speaking, I don’t like computer programs to do much of anything “automatically,” especially not at the behest of an (untrusted, of course) end-user.   However, when dealing with a legacy application that’s now in-service, you do not always have all of the practical options that you would like.   If you know why the auto-loading is happening and if you are comfortable with the overall security of the present design (neither of which I am specifically commenting-on here ...), then the most practical strategy might well be to simply try to make the million-pound elephant that’s paying the bills just a little bit more comfortable.

Plack is, as you can see, a family of related packages ... the reference implementation of the so-called PSGI protocol.   It does have a variety of “canned” interfaces, including ones for CGI, which allow you to adjust your existing application with a minimum of effort – for example, to run under Apache’s mod_fcgid or mod_fastcgi.   (Under the latter, which I am more familiar with, the so-called “dynamic server” option is basically designed for just this purpose, and Plack more-or-less can supply all the rest of the necessary glue.