CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

CVE-2019-11043 is a buffer overflow in PHP FastCGI Process Manager (FPM) that, in some versions and certain FPM configurations, can let an attacker write past allocated buffers and potentially achieve remote code execution. It matters because FPM is commonly used to run PHP applications behind web servers; successful abuse can give an attacker control of the PHP worker process and a path into the host or application data. CISA notes known ransomware use of this vulnerability, so treat exposure as high priority and confirm all version and configuration details against the vendor advisory.

How it works

This issue is classed as CWE-120 (classic buffer overflow). In affected PHP FPM setups, crafted input can cause the FPM module to write beyond the bounds of a buffer it has allocated. When that write is controllable, it can corrupt memory in ways that allow remote code execution in the context of the FPM process. Public detail on exact trigger conditions is limited to “some versions of PHP in certain configurations of FPM setup”; defenders should not assume every PHP or FPM deployment is vulnerable and must verify against the vendor advisory rather than relying on generic descriptions. Exploitation would typically target the web-facing path that hands requests to FPM, so the attack surface is the combination of the web server, the FastCGI interface, and the FPM pool configuration.

Am I affected? How to find it in your systems

PHP FPM commonly runs on Linux web tiers that serve PHP applications (for example behind nginx or Apache with FastCGI). Inventory steps:

• Identify hosts and containers that run php-fpm or equivalent package names; check process lists, service managers, and orchestration manifests for FPM pools.
• Record the installed PHP and php-fpm package versions and compare them to the fixed versions listed in the vendor advisory; do not rely on version numbers from secondary sources.
• Review FPM pool and web-server FastCGI configuration for the “certain configurations” called out in the advisory; misconfiguration or specific URI/path handling may be required for the flaw to be reachable.
• Search configuration management, image registries, and CMDB entries for PHP-FPM base images or roles so you catch non-standard or legacy stacks.

For signs of exploitation, review web and FPM logs for anomalous requests that precede worker crashes, unexpected child process behavior, or sudden FPM restarts. Host telemetry showing unusual process execution from the FPM user, new outbound connections, or ransomware-related activity should be investigated promptly. Exact indicators of compromise are not provided here; align detection with your vendor’s guidance and your environment’s baseline.

How to remediate

Patch first. Apply the updates specified by the PHP vendor (or your distribution’s security advisory) for the PHP FastCGI Process Manager components you run, following CISA’s required action: apply updates per vendor instructions. After patching:

• Restart FPM pools and dependent web services in a controlled manner and verify the running binary/package version matches the fixed release.
• Re-check FPM and FastCGI configurations so you are not leaving unnecessary attack surface (restrict which scripts FPM will execute, tighten pool user privileges, and limit network exposure of the FastCGI socket or port).
• Redeploy updated images or packages through your normal CI/CD and configuration-management pipelines so ephemeral and autoscaled nodes do not reintroduce the vulnerable build.

Hardening for this class of flaw includes running FPM under least privilege, isolating pools per application, and ensuring the web server only forwards expected paths to FPM.

If you can't patch immediately

If you cannot complete the vendor update at once, reduce risk with compensating controls while you schedule the patch:

• Segment FPM hosts so they are not directly reachable from untrusted networks; restrict management and FastCGI interfaces to the web tier only.
• Apply virtual patching or WAF rules that block request patterns associated with this vulnerability class, tuned and tested so you do not break legitimate traffic; confirm rule efficacy against the vendor advisory description.
• Disable or bypass FPM for applications that can temporarily run under a different, non-vulnerable PHP SAPI, or take non-critical PHP apps offline until patched.
• Increase monitoring on FPM process crashes, privilege use, file writes outside application directories, and ransomware behaviors; alert on deviations from baseline.

These measures do not replace the patch; they only buy time.

If your data may have been exposed

Actively exploited vulnerabilities, including those with known ransomware use, frequently lead to full host or application compromise and data theft or encryption. If you had a reachable vulnerable FPM instance, assume possible unauthorized access until you have reviewed logs, host forensics, and backup integrity. Rotate credentials that may have been present on the host, check for persistence, and follow your incident-response plan. You can run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in public breach corpora while you complete containment and recovery.