If you run ColdFusion or Lucee on a Windows server with IIS, and you've never installed PHP on purpose, this one's for you. There's a good chance PHP is on your server. It may be left behind by a control panel, a phpMyAdmin install from years ago, or your host's setup image. Here's how to find out in a few minutes with PowerShell, and how to remove it safely if nothing uses it.
I remember when I could go years without applying a security fix. Now it feels like I'm chasing something down every few weeks: a patch here, a mitigation there, a bot hammering a page that shouldn't exist. Such is life in the AI era, sigh.
While I was signing in to my test blog the other day, the admin page refused me with a plain IIS error: 403 Forbidden, and a message saying multipart form-data requests were blocked by a PHP mitigation. My blogs are ColdFusion. They don't run a single line of PHP. So why was a PHP security rule stopping me from signing in?
