Is it a Virus?
✔ NO - Safe
Typically located in C:\Program Files\PHP\ or C:\PHP\; ensure the file is part of a legitimate PHP distribution.
Warning
Multiple php-cgi.exe processes can appear under load
Each FastCGI worker or request may spawn a php-cgi.exe instance; high counts can indicate configuration or attack.
Can I Disable?
✔ ES
Disabling requires server-level changes (e.g., disable CGI/FastCGI or remove PHP from the web server) and may affect PHP-enabled sites.
What is php-cgi.exe?
php-cgi.exe is the PHP CGI executable used by web servers to execute PHP scripts when CGI or FastCGI is configured. It launches to handle PHP requests, often spawning a per-request process or using a pool, depending on the server setup. It is common in Windows hosting stacks with IIS or XAMPP.
php-cgi.exe runs the PHP interpreter in CGI/FastCGI mode and communicates with the web server via STDIN/STDOUT. It handles PHP code execution for requests and typically runs in a managed pool to improve concurrency and isolation between requests.
Quick Fact: PHP-CGI helped establish CGI-style execution for PHP; FastCGI later improved performance by reusing worker processes.
Types of PHP-CGI Processes
- CGI/ FastCGI Runner: Executes PHP scripts on demand as configured by the web server (Apache, Nginx, IIS).
- Worker Process: Handles PHP request execution within a FastCGI pool.
- Bootstrap Process: Starts a PHP process when a new PHP request is received.
- Environment Controller: Sets PHP environment for each request, including php.ini settings.
- CLI Script Runner: Can be invoked by CLI-based PHP scripts or maintenance tasks.
Is php-cgi.exe Safe?
Yes, php-cgi.exe is safe when it comes from official PHP distributions and is invoked by a legitimate web server. Ensure you install from php.net or your server vendor.
Is php-cgi.exe a Virus or Malware?
The real php-cgi.exe is not a virus. Malware can masquerade with similar names; verify digitally signed and legitimate path.
How to Tell if php-cgi.exe is Legitimate or Malware
- File Location: Check that the file is located at C:\Program Files\PHP\php-cgi.exe or C:\PHP\php-cgi.exe. Unusual locations are suspicious.
- Digital Signature: Right-click the file in Explorer > Properties > Digital Signatures. Should show "The PHP Group" or a legitimate PHP distributor.
- Resource Usage: Typical per-request CPU/memory is modest; consistently abnormal CPU or memory when idle may indicate tampering.
- Behavior: PHP-CGI should be launched by the web server for PHP requests; persistent background activity with no server trigger is suspicious.
Red Flags: If php-cgi.exe is found outside typical PHP folders (e.g., Temp or AppData), runs without a web server trigger, lacks a valid signature, or shows constant high resource use, scan with antivirus and verify server configuration.
Why Is php-cgi.exe Running on My PC?
php-cgi.exe runs when a PHP-enabled web server processes requests. In CGI or FastCGI mode, the server may launch a new php-cgi.exe per request or reuse a pool of workers to handle multiple requests.
Reasons it's running:
- Active PHP Requests: Your web server is handling PHP pages; each request may spawn or reuse a PHP-CGI worker to execute the script.
- FastCGI Pool Reuse: A pool of php-cgi.exe workers can handle many concurrent requests, leading to multiple instances running simultaneously.
- Background PHP Tasks: Web apps may trigger background PHP tasks or scheduled scripts that run via PHP-CGI.
- Server Startup: On server restart or application pool recycle, new php-cgi.exe processes may start to service requests.
- CGI Wrappers or Proxies: Load balancers or reverse proxies can cause additional CGI processes to be spawned as part of request distribution.
Can I Disable or Remove php-cgi.exe?
Yes, you can disable php-cgi.exe. If you disable CGI/FastCGI support or remove PHP from the web server, the PHP scripts will no longer execute.
How to Stop php-cgi.exe
- Stop the Web Server: IIS: Stop the World Wide Web Publishing Service (W3SVC). Apache: run httpd -k stop or stop the Apache service from Services.msc.
- Disable CGI/FastCGI: IIS: In IIS Manager, remove the PHP CGI handler mapping or disable the FastCGI module. Apache: comment out the PHP-CGI/ PHP-FPM configuration in httpd.conf or enable only mod_php if desired.
- Prevent Startup: If PHP-CGI is registered as a Windows service, disable that service in Services.msc.
- Stop Application Pool (IIS): IIS Manager > Application Pools > Stop the PHP-related pool to halt new php-cgi.exe instances.
- Restart Web Server: Restart the web server to apply the changes and ensure no new php-cgi.exe processes start.
How to Uninstall PHP and php-cgi.exe
- ✔ Windows Settings → Apps → Apps & Features → Google PHP (or PHP) → Uninstall
- ✔ Control Panel → Programs → Uninstall a program → PHP distribution → Uninstall
- ✔ Remove leftover PHP-related files from your web server configuration (e.g., httpd.conf, IIS config) and delete PHP directories such as C:\Program Files\PHP or C:\PHP
Common Problems: High CPU or Memory Usage
If php-cgi.exe is consuming excessive resources:
Common Causes & Solutions
- Too Many Concurrent PHP Requests: Limit MaxRequestWorkers or PHP-FPM pool size; consider enabling OPcache and reusing workers.
- Misconfigured FastCGI Settings: Tune max processes, timeout, and idle heuristics in your web server or FastCGI configuration.
- Large or Complex PHP Scripts: Optimize code, use caching, and break long-running tasks into asynchronous jobs.
- Insecure or Malicious Extensions/Code: Review PHP scripts and extensions for vulnerabilities; remove or replace risky components.
- Outdated PHP Version: Update PHP to a supported version and apply security patches.
- Hardware Acceleration or IO Bottlenecks: Move heavy IO tasks off PHP scripts; enable OPcache; monitor disk I/O and upgrade hardware if needed.
Quick Fixes:
1. Open Task Manager or your web server's monitoring tool to identify high-usage php-cgi.exe processes.
2. Increase or tune FastCGI/Worker limits (e.g., MaxRequestWorkers).
3. Restart the web server to apply changes.
4. Update PHP and extensions to latest stable versions.
5. Enable OPcache and review long-running scripts for optimization.
Frequently Asked Questions
Is php-cgi.exe a virus?
No, the legitimate php-cgi.exe from PHP distributions is not a virus. Verify the path is a PHP installation directory (e.g., C:\Program Files\PHP or C:\PHP) and that it is digitally signed by a trusted PHP distributor.
Why is php-cgi.exe running when there is no web traffic?
php-cgi.exe may run due to a running PHP-FastCGI pool, background PHP tasks, or a misconfigured server that keeps workers alive. Check your web server's application pool settings and scheduled tasks.
Can I delete php-cgi.exe?
Only if you don't need PHP support on the server. Uninstall the PHP distribution or disable CGI/FastCGI in your web server; deleting the file without removing the web server configuration can cause PHP pages to fail.
Can I disable php-cgi.exe?
Yes. Disable CGI/FastCGI in the web server configuration or stop the PHP application pool. This will prevent PHP scripts from running until you re-enable it.
Why is php-cgi.exe running at server startup?
If CGI/FastCGI is enabled, the web server may initialize a PHP-CGI worker pool on startup to service requests quickly. This is expected behavior in properly configured environments.
How do I reduce php-cgi.exe memory usage?
Limit the number of concurrent PHP workers, enable OPcache, optimize PHP scripts, and consider switching to a persistent FastCGI pool rather than per-request spawning.