The php functions “exec”, “system”, “popen” (and similar) keep file descriptors of the parent process opened. When a new process is run this program will inherit all opened file descriptors of its parent. This can be used by hostile programs to listen and accept connections on port 80, or write to the apache log files.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/51226/php-fd.txt
Source: https://packetstormsecurity.com/files/51226/php-fd.txt.html