Security Tips: expose_php is currently enabled, disable it in php.ini.

So do I.  I checked both the site php.ini and the one in the cmsb foolder, and both are the same, off.

Hi Guys, 

It could be that it there's another PHP config file being read, or it could be that your server admin has disabled the ability to change that setting.

You can see what the actual value is by checking phpinfo().  Click the phpinfo link at the bottom of Admin > General or use this direct link:
admin.php?menu=admin&action=phpinfo

Search for "expose_php".  The value of the right is the "system value", and the value on the left is the "local value".  The local value is the one that is used and represents what the value is after all the config files are parsed.  If that one says "On", then expose_php is still on.  

You can actually check for yourself with a site like this.  Just look for the PHP Version in the headers: http://tools.seobook.com/server-header-checker/

Here's what the headers from our site look like: 
http://tools.seobook.com/server-header-checker/?url=www.interactivetools.com

What I'd recommend is just email your host and tell them you noticed that expose_php was enabled on your server and ask if they could disable it or provide you with instructions to disable it.

Hope that helps!