Just about all the results there appear to be abandoned cPanel placeholders and similar — very few even have domains. I couldn't look at all of them, obviously, but this seems to bear out the idea that nothing anyone cares about is run on PHP-CGI.
My thought exactly. Anyone who keeps their stack up to date is using the Apache2 Handler or FastCGI. Even if they're still on Apache1, mod_php isn't vulnerable.
If you're serving sites for multiple different users (eg shared hosting) you can't safely use mod_php as all of the php would end up running under the same uid.
I bet there are still tens of thousands of otherwise secure php-cgi setups out there.
Comments
"In the wild" in this case was just their honeypots. Actually vulnerable site should be very rare.
Also, one would assume that any website still using php-cgi has plenty of other security vulnerabilities.
You would be surprised:
http://www.shodanhq.com/search?q=PHP-CGI
Just about all the results there appear to be abandoned cPanel placeholders and similar — very few even have domains. I couldn't look at all of them, obviously, but this seems to bear out the idea that nothing anyone cares about is run on PHP-CGI.
The headers suggest ancient, unmaintained systems running outdated, no longer supported software with multiple known vulnerabilities.
I would be surprised if these systems haven't already been p0wned a long time ago.
My thought exactly. Anyone who keeps their stack up to date is using the Apache2 Handler or FastCGI. Even if they're still on Apache1, mod_php isn't vulnerable.
If you're serving sites for multiple different users (eg shared hosting) you can't safely use mod_php as all of the php would end up running under the same uid.
I bet there are still tens of thousands of otherwise secure php-cgi setups out there.