Comment by cookiengineer

> Sounds like you didn't prove its vulnerable against a stock PHP server though, so that's not a great response.

No I proved exactly that. Learn to read.