Debian Linux Security Advisory 2465-1 - De Eindbazen discovered that PHP, when run with mod_cgi, will interpret a query string as command line parameters, allowing to execute arbitrary code.
132dc392faa1d0ed24275c516bc3f43d8f2d89f20f9fd699ba65d12b22ac8edd