CVE-2019-11043: PHP-FPM buffer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV active exploitation with ransomware use, and near-maximum EPSS make this an urgent patch.

What it is

PHP-FPM in certain configurations writes past allocated buffers into FCGI protocol data space, an out-of-bounds write (CWE-787, CWE-120). It affects PHP 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11, and can lead to remote code execution.

Impact

An unauthenticated remote attacker can corrupt memory and potentially execute arbitrary code in the PHP-FPM process context. That can lead to full compromise of the web application and its data.

Attack surface

Reached over the network via HTTP requests to a PHP-FPM-backed web server in affected configurations; the CVSS vector shows no privileges or user interaction required. Exploitation depends on the specific FPM setup.

Exploitation

CISA KEV lists it as actively exploited and known to be used in ransomware campaigns, and EPSS is 0.9978 (99.956th percentile). Public exploit references exist, including packetstorm and the phuip-fpizdam tool.

What to do

• Patch PHP to 7.1.33, 7.2.24, 7.3.11 or later, or apply the vendor updates referenced in the advisories.
• Apply the relevant OS vendor errata (Red Hat, Ubuntu, Debian, Fedora, SUSE) for packaged PHP.
• Review and harden FPM configuration, particularly nginx fastcgi_split_path_info and related path handling, to avoid the vulnerable configuration.
• Restrict network exposure of PHP-FPM and front-end web servers where possible, and monitor for exploitation attempts.

Detection

• Monitor web server and FPM logs for unusual request patterns targeting path info or FastCGI parameters.
• Watch for unexpected child process crashes or restarts in PHP-FPM.
• Use network or host detection for known exploit traffic and the phuip-fpizdam tooling.
• Alert on post-exploitation behavior such as new processes or files spawned by the web server user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.