The server could simply be running a patched PHP.