Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R01 Remote code execution on internet-facing PHP servers / R01-2
R01-2: PHP-FPM deployments wrongly treated as safe or as certainly vulnerable
Because code execution on PHP-FPM is disputed between the sources, an operator may deprioritise FPM servers or exhaust itself on them, resulting in either exposure left open or effort misplaced.
Rating 12 high · Likelihood 3 Possible · Impact 4 Major · Kind Security · Acceptance not recorded
Basis. The claim is disputed; the update is the same either way, so the risk is in the prioritisation.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| Security lead and AppSec | owner | Makes the prioritisation call. | 6 risks |
| Managed PHP platforms | treater | Most managed platforms run FPM. | 2 risks |
| The PHP security team | informer | Only the advisories can settle what was shown on FPM. | 7 risks |
What it arises from
- Request globals that survive a failed request. State from a request that failed is still there when the next one starts.
The evidence
| Claim | Status | Fact-check | Sources |
|---|---|---|---|
| Remote code execution is confirmed on PHP-FPM | disputed | A6 Established●●●●●● | PHP Foundation PHP PHP oss-security |
Treatments
| Treatment | Status | Where |
|---|---|---|
| Treat FPM as affected and update it on the same schedule | in place | Affected systems: versions, deployments, applications, inventory |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01 | Vulnerabilities in assets are identified, validated and recorded | Frameworks and control catalogues |
| ISO/IEC 27001 | 6.1.2 | Information security risk assessment: identify risks and their owners | Management-system standards |
The stories that tell it
- Where php2shell stands: many sites dark, millions of attempts, no confirmed breach (through Remote code execution on internet-facing PHP servers)
- Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third (through Remote code execution on internet-facing PHP servers)
On this site: Affected systems: versions, deployments, applications, inventory · Fact-check: how sure can you be of each claim