Critical Remote Code Execution Vulnerability (CVE‑2019‑11043) in PHP‑FPM Allows Remote Code Execution
What It Is — A buffer‑overflow flaw in the PHP FastCGI Process Manager (FPM) can be triggered by a specially crafted request, causing the FPM worker to write past allocated memory. Successful exploitation grants an attacker remote code execution (RCE) on the underlying host.
Exploitability — Public PoCs and exploit kits appeared shortly after disclosure; the vulnerability scores 9.8 (CVSS v3.1 Critical).
Affected Products — PHP 7.1.33, 7.2.24, 7.3.11 and earlier releases when FPM is configured with certain cgi.fix_pathinfo settings and a vulnerable php-fpm binary.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure configuration management and continuous verification that runtime parameters (e.g.,
cgi.fix_pathinfo) remain within approved baselines. - Patch latency directly impacts the audit evidence you can provide to regulators or customers; an unpatched FPM instance is a control gap across many frameworks.
- Continuous monitoring of process integrity and runtime behavior supplies defensible proof that the environment is free from known exploitable flaws.
Recommended Actions
- Apply the official PHP patches (upgrade to 7.1.34, 7.2.25, 7.3.12 or later).
- Review and harden FPM configuration: disable
cgi.fix_pathinfowhere not required, enforce least‑privilege file permissions. - Deploy runtime integrity monitoring to detect anomalous memory writes or unexpected process launches.
- Update your asset inventory and vulnerability management tools to flag any remaining vulnerable PHP‑FPM instances.
- Capture remediation evidence (patch logs, configuration snapshots) for audit readiness.
Source: CISA KEV – CVE‑2019‑11043