Hacker News Reader

"In the wild" in this case was just their honeypots. Actually vulnerable site should be very rare.

Also, one would assume that any website still using php-cgi has plenty of other security vulnerabilities.

You would be surprised:

http://www.shodanhq.com/search?q=PHP-CGI

Just about all the results there appear to be abandoned cPanel placeholders and similar — very few even have domains. I couldn't look at all of them, obviously, but this seems to bear out the idea that nothing anyone cares about is run on PHP-CGI.

The headers suggest ancient, unmaintained systems running outdated, no longer supported software with multiple known vulnerabilities.

I would be surprised if these systems haven't already been p0wned a long time ago.

My thought exactly. Anyone who keeps their stack up to date is using the Apache2 Handler or FastCGI. Even if they're still on Apache1, mod_php isn't vulnerable.

If you're serving sites for multiple different users (eg shared hosting) you can't safely use mod_php as all of the php would end up running under the same uid.

I bet there are still tens of thousands of otherwise secure php-cgi setups out there.

Reply on news.ycombinator.com