lighttpd should be configured to run PHP via CGI. Beyond that, we don't explicitly intend to disable CGI generally. If you change the config (instead of adding a config at /etc/lighttpd/external.conf or elsewhere), note that it will be overwritten when repairing or updating.