Un-Patched PHP-CGI remote code execution bug can expose Source Codes. A remote unauthenticated attacker could obtain sensitive information, cause a denial of service condition or execute arbitrary code with the privileges of the web server. The team that found the bug, known as Eindbazen. They said they had been waiting for several months for the PHP Group to release a patch for the vulnerability in order to publish information about the bug. The vulnerability can only be exploited if the HTTP server follows a fairly obscure part of the CGI spec.
Source: https://thehackernews.com/2012/05/un-patched-php-cgi-remote-code.html