old bug but still threre: looks like php code can take over any file descriptors, including apache's listening socket
I dislike PHP. It's because it's users. The lecturer tells about xss among others and guess what his site suffers from? sigh.
a nice blog entry on php code quality and why their security team went on the run (via fefe)
