Well, I guess if you run PHP in CGI (not FastCGI) your exploitability is going to be somewhat limited by performance, but still...