Related LiveOverflow video about fake exploits going around https://www.youtube.com/watch?v=7CiZmq2llDg
That said, OP is basically full of shit. This is absolutely exploitable and people are going to just assume the platform and ABI and spray it against the internet, particularly hoping for mod_php.
>This is absolutely exploitable...
OK, can you share a working one so we can test that our servers are fixed?
Aren't most PHP sites out there running mod_php anyway?
15 years ago absolutely. Most modern sites will be running php-fpm (or maybe FrankenPHP)
Yeah, I don't think I've touched mod_php ever since Apache 2.4 came up with mod_proxy_fcgi, allowing dead simple integration with php-fpm.
PHP does need to invest more in the built-in web server, though. Last time I checked, they still recommend against using it in production.
All other popular runtimes provide a standards-compliant HTTP daemon that any other HTTP daemon can proxy to, it's just the way things work nowadays. Insisting on FastCGI limits integration with more modern web servers and HTTP-speaking middleware.