The php-cgi binary provides a way for a web server to invoke PHP separately from an embedded Apache module. CGI starts a process for handling requests in the traditional model; FastCGI arrangements keep processes available across requests and have different performance and configuration behavior.
Because php-cgi is a distinct executable, a host may have different versions of PHP CLI, PHP-FPM and php-cgi installed at once. Examining php -v alone does not prove which one the web server launches.
CGI configuration also has its own security considerations. Directly exposing a CGI interpreter or incorrectly mapping request parameters can create vulnerabilities, so the server should use a documented, supported integration rather than ad hoc public entry points.
Inspect the web server's handler configuration, check the executable actually invoked, apply its matching security updates and retest request routing afterward.