They're running PHP as CGI - /usr/bin/php. From the current PHP INSTALL file:
Quote:
If you are running a web server PHP has
module support for, you should generally go for that solution for
performance reasons. However, the CGI version enables users to run
different PHP-enabled pages under different user-ids.
Warning
By using the CGI setup, your server is open to several possible
attacks. Please read our CGI security section to learn how to defend
yourself from those attacks.
If you're running a webserver with a module for PHP (Apache, for instance - which your host is using) then it is significantly more efficient and safe than using CGI. I'm currently using two hosts - Rackspace and a UK one called 34sp.com. Both use PHP compiled as a module. Pretty much any decent host should, in all honesty