Dutch ISP KPN actually has a hosting service that runs PHP primarily in CGI mode: https://www.google.com/#hl=en&output=search&sclient=... yields a massive amount of vulnerable sites.