In the past, Apache used to serve cgi files from
cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable cgi file from everywhere.
What is the security risk for serving webpages directly from executable cgi files? For example, what is the risk for
http://example.com/hello.cgi where executable file of hello.cgi is in the root (public) directory? (comparing with a non-executable PHP file of hello.php)?
Of course, cgi scripts are practically served via FastCGI to persist the connection, but does it have an better security too?