There has been [a](https://serverfault.com/questions/502790/security-issue-on-nginx-php-fastcgi-split-path-info) [lot](http://www.webhostingtalk.com/showthread.php?p=6807475#post6807475) [of](http://www.acunetix.com/vulnerabilities/nginx-php-code-execution/) [talking](http://cnedelcu.blogspot.fr/2010/05/nginx-php-via-fastcgi-important.html) about a security issue relative to the `cgi.fix_pathinfo` PHP option used with Nginx (usually PHP-FPM, fast CGI). 

As a result, the default nginx configuration file used to say: 

```
# NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini

```

However, now, the "official" Nginx wiki [states that](http://wiki.nginx.org/PHPFcgiExample) PATH\_INFO can be handled correctly without disabling the above PHP option. So what?

Questions
---------

* Can you explain clearly what does `cgi.fix_pathinfo` do? ([official doc just says](http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo): "For more information on PATH\_INFO, see the CGI specs")
* What will PHP really do with these `PATH_INFO` and `SCRIPT_FILENAME` variables?
* Why and how can it be dangerous with Nginx? (*detailed* examples)
* Does the issue still exist in recent versions of these programs?
* Is Apache vulnerable?

I'm trying to understand the issue at each step. For example, I don't understand why using the php-fpm Unix socket [could avoid](https://stackoverflow.com/questions/23390531/access-denied-403-for-php-files-with-nginx-php-fpm/23393266#23393266) this problem.