Underflow in PHP-FPM can lead to RCE (CVE-2019-11043)

What is affected, what to do

This vulnerability allows a buffer overflow in the PHP FastCGI Process Manager (FPM), enabling remote code execution (RCE). An attacker can execute arbitrary code without authentication on affected systems. The vulnerability is actively exploited in ransomware campaigns since 2022. Affected are PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11, as well as certain Ubuntu systems. Immediate patching to the latest version is urgently required.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update PHP to version 7.1.33, PHP to version 7.2.24, PHP to version 7.3.11. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• PHP lt 7.1.x..7.1.33
• PHP lt 7.2.x..7.2.24
• PHP lt 7.3.x..7.3.11

Fixed in

• PHP 7.1.33
• PHP 7.2.24
• PHP 7.3.11

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade PHP to a patched minor release immediately: 7.1.33, 7.2.24 or 7.3.11 (or any later branch). Prefer distribution packages: apt-get update && apt-get install --only-upgrade php7.2-fpm on Ubuntu/Debian. Restart with systemctl restart php*-fpm nginx and confirm via php-fpm -v.
   • Enumerate exposed nginx+PHP-FPM configurations, specifically the vulnerable combination of fastcgi_split_path_info ^(.+?\.php)(/.*)$; plus fastcgi_param PATH_INFO $fastcgi_path_info; without a preceding try_files $uri =404;. List candidates with grep -R "fastcgi_split_path_info" /etc/nginx/.
   • As an emergency workaround before patching, insert try_files $uri =404; into every FastCGI location block and reload nginx (nginx -t && systemctl reload nginx). This blocks the PoC path that appends URL fragments past the .php extension.
   • Instruct perimeter WAF or reverse proxy to drop requests containing newline characters (%0a) in the URI and unusually long PATH_INFO suffixes after .php/. This signature covers the public "phuip-fpizdam" exploit.
   • Scan internet-exposed PHP-FPM hosts first (Shodan tag php-fpm, filter internal CMDB for PHP workloads) and treat them as crown-jewel risk until patch confirmation. On suspected compromise, hunt for web shells under /var/www, cron modifications and newly created SUID binaries.
2. 02

   Runbook step 2

   Mitigation layers

   • Network: Never expose the PHP-FPM socket (TCP 9000) directly to the internet — bind to a Unix socket or localhost only. Enforce egress filtering on web servers to block reverse shells (outbound TCP 4444, 1337, random high ports to external IPs).
   • Web server hardening: Always place try_files $uri =404; before fastcgi_pass in nginx. Alternatively drop fastcgi_split_path_info if the application does not need PATH_INFO. For Apache mod_proxy_fcgi, audit ProxyPassMatch regexes for the same pattern.
   • Endpoint: Enforce AppArmor or SELinux profiles for php-fpm that restrict writes to /var/www, /tmp and /dev/shm. Extend disable_functions in php.ini to include exec,passthru,shell_exec,system,proc_open,popen.
   • IAM/least-privilege: Run PHP-FPM pools under dedicated per-vhost unprivileged users (user = www-vhost1) rather than a shared www-data. Set file permissions to 0640 / 0750 owned by root:www-vhost1 so that RCE cannot overwrite application code.
   • WAF/IPS: Deploy a Suricata/Snort rule matching URI pattern \.php/[^\s]{200,} and presence of %0a after .php/. Enable ModSecurity CRS rule 932160 (RCE) plus a custom SecRule REQUEST_URI "@rx \.php/.*\x0a".
   • Container estates: Migrate from legacy 7.x to maintained php:8.x-fpm images; integrate an image scanner (Trivy, Grype) into CI that blocks CVE-2019-11043.
3. 03

   Runbook step 3

   Detection rules

   • Nginx/Apache access logs: unusually long URIs with .php/ followed by payload data. KQL shape: WebLogs | where cs_uri_stem matches regex @"\.php/.{150,}" | summarize count() by c_ip, cs_host.
   • Sysmon/auditd on web servers: child processes of php-fpm outside the baseline, in particular /bin/sh, bash, nc, python, perl, curl, wget. Sigma shape: parent_image: '*/php-fpm*' and process: ['*/sh','*/bash','*/nc','*/curl','*/wget'].
   • auditd rule for writes by the www-data user outside /var/lib/php/sessions and /var/www/*/uploads: -a always,exit -F arch=b64 -S openat -F auid=33 -F dir!=/var/www -k php_fpm_write_anomaly.
   • Network telemetry (Zeek conn.log): outbound connections from web server IPs to non-business ports (4444, 1337, 8443 toward non-CDN IPs). Alert on orig_h in webserver_subnet and resp_p not in [80,443,53,123].
   • EDR process ancestry: alert when php-fpm → sh → network tool occurs within 5 seconds. This is the canonical phuip-fpizdam payload pattern.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• Canonical Canonical Ubuntu Linux
• Debian Debian Linux
• Fedora Project Infrastructure Fedora
• PHP Group PHP
• Red Hat Redhat Enterprise Linux
• Red Hat Redhat Enterprise Linux Desktop
• Red Hat Red Hat Enterprise Linux Extended Update Support (EUS)
• Red Hat Enterprise Linux Eus Compute Node
• Red Hat Enterprise Linux For Arm 64
• Red Hat Enterprise Linux For Arm 64 Eus
• Red Hat Red Hat Enterprise Linux For IBM Z Systems
• Red Hat Red Hat Enterprise Linux For IBM z Systems Extended Update Support (EUS) 7.1 s390x

Weakness classes (CWE)

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  Base

  The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

  Entry at MITRE CWE-120

References & sources

• github.comneex/phuip-fpizdamx_refsource_MISC, Exploit, Third-party advisory
• bugs.php.netbug.php?id=78599x_refsource_CONFIRM, Exploit, Issue tracking, Patch, Vendor advisory
• usn.ubuntu.comUSN-4166-1Vendor advisory, x_refsource_UBUNTU, Third-party advisory
• debian.orgDSA-4552Vendor advisory, x_refsource_DEBIAN, Mailing list, Third-party advisory
• debian.orgDSA-4553Vendor advisory, x_refsource_DEBIAN, Mailing list, Third-party advisory
• usn.ubuntu.comUSN-4166-2Vendor advisory, x_refsource_UBUNTU, Third-party advisory
• support.f5.comcsp/article/K75408500?utm_source=f5support&utm_medium=RSSx_refsource_CONFIRM, Third-party advisory
• lists.fedoraproject.orgFEDORA-2019-4adc49a476Vendor advisory, x_refsource_FEDORA, Mailing list, Third-party advisory
• security.netapp.comadvisory/ntap-20191031-0003x_refsource_CONFIRM, Third-party advisory
• access.redhat.comRHSA-2019:3286Vendor advisory, x_refsource_REDHAT, Third-party advisory
• access.redhat.comRHSA-2019:3287Vendor advisory, x_refsource_REDHAT, Third-party advisory
• access.redhat.comRHSA-2019:3299Vendor advisory, x_refsource_REDHAT, Third-party advisory
• access.redhat.comRHSA-2019:3300Vendor advisory, x_refsource_REDHAT, Third-party advisory
• lists.fedoraproject.orgFEDORA-2019-187ae3128dVendor advisory, x_refsource_FEDORA, Mailing list, Third-party advisory
• lists.fedoraproject.orgFEDORA-2019-7bb07c3b02Vendor advisory, x_refsource_FEDORA, Mailing list, Third-party advisory
• lists.opensuse.orgopenSUSE-SU-2019:2441Vendor advisory, x_refsource_SUSE, Mailing list, Third-party advisory
• access.redhat.comRHSA-2019:3724Vendor advisory, x_refsource_REDHAT, Third-party advisory
• access.redhat.comRHSA-2019:3735Vendor advisory, x_refsource_REDHAT, Third-party advisory
• access.redhat.comRHSA-2019:3736Vendor advisory, x_refsource_REDHAT, Third-party advisory
• synology.comsecurity/advisory/Synology_SA_19_36x_refsource_CONFIRM, Third-party advisory