According to security case 4 of Chapter 4 in PHP manual.
I use PHP-CGI that is in outside of webtree.

like this...
#!/usr/bin/php4
<?
   echo "abc";
?>

If I run this cgi sript with apache web server. it's result
is "abc" as you can expected. But, when I run it on BOA web
server it's result is "#!/usr/bin/php4 abc".

Some month ago. I've met also same problem with apache web
server in same situation. Of cause, I can get right result
with apache server, now. But. not with BOA.

I remember thttpd displayed same wrong result, too.