Because we use it as the shell to launch not only external processes, but built-in commands such as dir that are not found in separate binaries.

I can see the use, but can't see how to implement it without breaking backwards compatibility.

Perhaps you could create a new function, or even add an extra optional boolean parameter to EXEC() that would when "true" would not use CMD.EXE?

E.g.
$no_cmd = true;
EXEC("c:\\winnt\\notepad.exe", $result, $status, $no_cmd);

This wouldn't break old code?

we already have bypass_shell for proc_open, we could do something similar for exec (or just document this better and advise people on windows to use proc_open if they don't want the additional cmd.exe to be executed).

Changing this to any version, as the BC break should be low enough to be allowed to be introduced in a x.z release

Thinking about this more, I think like Ferenc said, we should document this better and point to the bypass_shell open for proc_open() to keep BC. Adapting to proc_open() from exec() should be really straight forward.

Reclassifying the report to be a documentation type.

This bug has been fixed in the documentation's XML sources. Since the
online and downloadable versions of the documentation need some time
to get updated, we would like to ask you to be a bit patient.

Thank you for the report, and for helping us make our documentation better.