As has been mentioned, using CGI for php is quite outdated so it probably doesn't impact that many sites, that said this sort of vulnerability is exactly why you should put all but the minimum front controller PHP in a folder that's outside of the public folder your site is being served from.
Comments
As has been mentioned, using CGI for php is quite outdated so it probably doesn't impact that many sites, that said this sort of vulnerability is exactly why you should put all but the minimum front controller PHP in a folder that's outside of the public folder your site is being served from.
Absolutely not. Lighttpd and Nginx both use it, and have recently picked up a lot of popularity because of it.
It maybe an old mechanism, but it is fast, which is worth something these days :)
Those generally use FastCGI, which again, is not vulnerable.
nginx doesn't even have plain CGI support. The SimpleCGI wrapper does not count.