CVE-2019-11043

PHP-FPM is the part of PHP that runs website code. This bug is like a mistake in how it handles input size—an attacker can use it to make the server run their own instructions remotely. If exploited, it can lead to a full compromise and ransomware-style attacks.

This matters if your business runs web applications using PHP-FPM on servers where PHP is in the affected version range (PHP 7.1.x below 7.1.33, 7.2.x below 7.2.24, or 7.3.x below 7.3.11) and your PHP-FPM setup matches the vulnerable configuration. It’s a network-remote issue and does not require a login or user interaction.

Reachability depends on whether an attacker can reach the web server that forwards requests to PHP-FPM, and whether the specific FPM configuration that triggers the flaw is in use.

This is RED because attackers have used it in ransomware campaigns (CISA KEV lists it as known exploited), and public exploitation is available. The safest move is to treat any affected PHP-FPM deployment as compromised-risk and remediate immediately.

Confirm exposure

1. Identify the PHP-FPM version(s) installed and in use for your web apps.
   • If you are on PHP 7.1.x, check whether it is older than 7.1.33.
   • If you are on PHP 7.2.x, check whether it is older than 7.2.24.
   • If you are on PHP 7.3.x, check whether it is older than 7.3.11.
2. Confirm your deployment uses PHP-FPM behind a front-end web server (common setups include nginx or another proxy passing requests to FPM).
3. Because exploitation depends on “specific FPM configurations,” have your admin confirm the exact FPM/fastcgi handling in place (not just the presence of PHP-FPM).

Upgrade to fixed versions (preferred remediation)

• Upgrade PHP to one of the fixed releases:
  • PHP fixed in 7.1.33
  • PHP fixed in 7.2.24
  • PHP fixed in 7.3.11
• If Tenable.sc is part of your environment, ensure it is updated to 5.19.0 (fixed per findings).

Temporary mitigation if patching is delayed

• Apply a front-end guard in your nginx (or equivalent) configuration so that only existing files are passed to PHP-FPM.
  • Example approach from findings: use try_files $uri =404 (nginx) or an if (-f $uri)-style existence check.
• The goal is to prevent the specific request paths that could trigger the underflow condition from reaching PHP-FPM.

KEV timing

• CISA KEV due date: 2022-04-15.

After change

• Re-check that the running PHP-FPM binary/version is the updated one.
• Monitor web server and PHP-FPM logs for unusual requests around the times of exposure attempts, and watch for unexpected process/file changes consistent with server compromise.

CVE-2019-11043 is rated HIGH and describes a buffer underflow in PHP-FPM that can enable Remote Code Execution over the network without authentication or user interaction. The flaw is specifically tied to PHP versions 7.1.x < 7.1.33, 7.2.x < 7.2.24, and 7.3.x < 7.3.11 when used with particular FPM configurations.

Exploitation status: CISA KEV lists this vulnerability as confirmed exploited, and it has been used in ransomware campaigns; KEV remediation action was to apply vendor updates. Public exploit availability is noted (1 known), indicating exploit maturity sufficient for real-world targeting.

KEV meaning here: inclusion means CISA has high confidence it has been exploited in the wild, so organizations should treat it as actively weaponized rather than a purely theoretical risk.