if you have the class catching the /cgi-bin/ as the first class in the list, then anything not caught by it will be processed by the second class - no need to actually define a specific regexp for it.
Note that there are various ways to make requests containing cgi-bin so make your regexp catch all of them (e.g. /dir1/../../cgi-bin/) also, if you want these requests to be dropped, you will need to have no pool on the class and no pool on the VS (the pool will be configured on the second class that processes the traffic). Another option would be to have a redirect to the homepage on the cgi-bin class.
Thanks,
Tom.