Well, for what it's worth, I think the best practice was always to test the existence of the PHP script, either with `try_files`, or with `if`, so, if you do that, then you aren't vulnerable, according to the exploit.

E.g., if you follow the "PHP FastCGI Example" from nginx.com, then nginx would protect you from this vulnerability in PHP-FPM:

* http://web.archive.org/web/20150928021324/https://www.nginx....

Here's the current version of the page, which seems to have the same info as the archived one above:

* https://www.nginx.com/resources/wiki/start/topics/examples/p...

(I think it used to be at another URL prior to the involvement of the marketing department in 2015; not sure if it's worth finding at this point, because the bug is not even in nginx in the first place.)

Mailinabox as well.

According to [1] mailinabox seems to be not affected.

[1] https://github.com/mail-in-a-box/mailinabox/issues/1663#issu...

Good news, and good to see them respond so fast as well. I looked through the config files (could not get the exploit to work for some reason) and found the exact offending lines and jumped to the wrong conclusion. Weird how the config appears to have the exact setup that NextCloud has and yet it does not seem to be exploitable. Wonder why that is.

Exploit required specific combination of software and config lines. MIAB didn't have those lines.

That's not to say another similar exploit might have worked a different way. Luckily that bug is patched now.