What it is
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.