> many existing PHP pages, as just one example. Not really. Deploying PHP with CGI is very uncommon, as we've seen from the fallout from CVE-2012-1823 which wa

> many existing PHP pages, as just one example. Not really. Deploying PHP with CGI is very uncommon, as we've seen from the fallout from CVE-2012-1823 which was a much worse bug. Anything vulnerable to that has the potential of being vulnerable again, but that wasn't what you would think of as web applications: some embedded web interfaces, some really bad control panels, that sort of thing.