There is a remote exploit in the wild for PHP 5.4.3 in Windows, which takes advantage of a vulnerability in the com_print_typeinfo (http://php.net/manual/en/function.com-print-typeinfo.php) function. The php engine needs to execute the malicious code, which can include any shellcode like the the ones that bind a shell to a port...
See: http://isc.sans.org/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255
Exploit: hxxp://www.exploit-db.com/exploits/18861/
(change the hxxp to http to see it)