I have an Ubuntu Server 12.04 installed on a VM. This server has apache2-mpm-prefork and libapache2-mod-php5 installed. I was looking through the logs and recently came across these rather suspicious entries:
xx.xx.xx.xx - - [20/Jan/2014:09:00:04 +0000] "HEAD / HTTP/1.0" 200 274 ...
xx.xx.xx.xx - - [20/Jan/2014:09:00:23 +0000] "POST /cgi-bin/php?%2D%64+...
xx.xx.xx.xx - - [20/Jan/2014:09:00:25 +0000] "POST /cgi-bin/php5?%2D%64...
...
Decoding the content after php?...
results in the following:
-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d
disable_functions="" -d open_basedir=none -d
auto_prepend_file=php://input -d cgi.force_redirect=0 -d
cgi.redirect_status_env=0 -n
Is this something I should be concerned about?