This question already has an answer here:
- Allow setuid on shell scripts 8 answers
I find php files with SGID bit and read-only & execute. The group is root. Is this a problem?
Because a user will need to run the php interpreter with their our account, could it led to privilege escalation?
Like, the user www-data runing php as www-data and call the file with SGID bit, could he became root?