I'm surprised by CGI. The vulnerability description talks about a second request being affected by corrupted state from an earlier request. But I thought CGI only processes one request per process?
But there were two vulns - only the second required the two requests.
How does that work? Exec(ve) without fork? That should still clean up the PHP state.