Lighttpd

Afaics the exploit uses an url like this (escaping all the stuff ofc):

/cgi-bin/php5-cgi?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -n

Now either apache appends this query string to the exec call as argument(s), in which case apache is to blame, and lighttpd is not vulnerable (in mod_cgi we only call exec with a configured handler and the filename as the only parameter, or directly the filename if it is an executable itself and an empty handler is configured. no query string ever gets used as argument).

Or php reads commandline options from the query string (but I think this is unlikely), in which case only php is to be blamed.