Yo, testing latest 1.12 and found that it cannot load "php-cgi.exe" as ENV. PHP is maintained by package manager for Windows (scoop in this case) and is runnable from everywhere. Should I setup the ...

The bug is somewhere in 0ab996a (previous commits works fine, this one and later do not). Yes, php-cgi.exe is in PATH (otherwise the previous commits wouldn't work either).

Even when PHP isn’t set to CGI mode, however, the vulnerability may still be exploitable when PHP executables such as php.exe and php-cgi.exe are in directories that are accessible by the web ...