There seems to have been some confusion about the effect of this feature on PHP in previous threads on HN. If you are running mod_php you are unaffected even if you use exec / system etc as the Apache PHP SAPI doesn't pass the environment variables to the sub process.

However if you pass any user data (_POST, _GET, etc) into a system/exec etc call that sets an environment variable then you would be vulnerable.