Recently, I have got a few 404 errors where the user has requested PHP pages.

The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of the request.


Which translates to something like:


I do not have cgi-bin or php folders exposed so I am not overly concerned about these requests but I am curious as to what they are looking for to ensure I am patched up.

1 Answer 1


All of the exploit boards are exploding with the recent Apache + PHP 5.x remote code execution vulnerability. Every HTTP server on the planet is getting hit with this right now.

  • remove code execution vulnerability :) ... the script you linked feels like 2001. Commented Nov 6, 2013 at 7:25
  • Thanks for the link - How do I determine if I am vulnerable without running the linked script?
    – Kami
    Commented Nov 6, 2013 at 10:04
  • @that guy from over there yeah CGI injection, thats bizzare. Its actually the 2nd variant of this attack, one very similar to it came out a few years ago.
    – rook
    Commented Nov 6, 2013 at 16:22
  • iirc it was also part of that latest plesk-thingie, i see the scanners going around every then and there. Commented Nov 6, 2013 at 18:32
  • @Kami: you might check if /cgi-bin/php[3,4,5] is a valid path on your server. if so, you might check some of the URLS given in Rook's link (use GET, not POST) Commented Nov 6, 2013 at 18:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .