Loading story…
CVE-2019-11043 is a PHP-FPM vulnerability caused by incorrect PATH_INFO handling in fpm_main.c, which can trigger a buffer underflow and permit remote code execution. An attacker can use a crafted URI containing a newline to manipulate FastCGI environment-variable processing and redirect writes within PHP-FPM's CGI environment buffer.
Exploitation is configuration-dependent, affecting deployments that use Nginx fastcgi_split_path_info, forward PATH_INFO to PHP-FPM, enable cgi.fix_pathinfo, and lack—or permit bypass of—a check that the requested PHP file exists. The attack can overwrite a colliding HTTP header as PHP_VALUE, allowing attacker-controlled PHP configuration directives to form an RCE chain; reliability depends on Nginx URI matching, environment-variable ordering, and payload-size constraints.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A technical analysis documented how incorrect PHP-FPM PATH_INFO handling could yield a buffer underflow and environment-buffer corruption, enabling attacker-controlled PHP_VALUE directives and potential RCE. It noted exploitation requires particular non-default Nginx and PHP-FPM configurations and can be mitigated by preventing nonexistent PHP paths from reaching PHP-FPM.
A PHP bug report identified an underflow involving env_path_info in fpm_main.c that could lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how `CVE-2024-2961`, a long-standing buffer overflow in glibc's `iconv` implementation for `ISO-2022-CN-EXT`, can be exploited to achieve remote code execution in PHP applications. The technique, dubbed **CNEXT**, builds on earlier work around PHP filter chains and error-based file-read oracles, showing how `php://filter` can be abused not just to read files but to manipulate PHP heap allocations and corrupt internal memory structures. By chaining filters such as `convert.iconv`, `zlib.inflate`, and `dechunk`, the exploit can steer allocator behavior and overwrite `zend_mm_heap` hooks so that PHP ultimately invokes `system()`. The write-up says the method is reliable across PHP `7.0.0` through `8.3.7` and can be delivered in a single GET request, significantly raising the impact of otherwise limited file-read primitives. A demonstrated attack used the WordPress BuddyForms flaw `CVE-2023-26326` to gain file-read access and then escalate to code execution, while the researchers warned that the same path could affect other PHP file-read sinks, including XXE and SQL injection scenarios involving `LOAD DATA LOCAL INFILE`. The findings also revive attention on PHP filter-chain abuse first explored in prior research, showing that seemingly minor disclosure bugs can become full server compromise when combined with glibc and PHP internals.
Jun 29, 2026
A critical remote code execution vulnerability in PHP on Windows, tracked as **`CVE-2024-4577`**, allows argument injection in **PHP-CGI** through Windows Best-Fit character encoding conversion. The flaw affects supported and unsupported PHP 5.x+ versions and is especially dangerous in CGI deployments where `php-cgi.exe` or `php.exe` is exposed to the web, including common default **XAMPP**-style configurations. Researchers reported that specially crafted HTTP requests can bypass prior protections and achieve remote code execution without authentication. Security updates were released in **PHP 8.3.8, 8.2.20, and 8.1.29**, but exploitation began rapidly after disclosure. Multiple reports said attackers were using crafted POST requests to launch `mshta.exe`, retrieve a malicious HTA payload, and execute **TellYouThePass** ransomware via in-memory VBScript loading. Defenders were urged to patch immediately and, where patching was not yet possible, restrict or disable PHP-CGI exposure and apply web-server filtering and configuration mitigations to block exploit requests.
Sep 3, 2026
F5 disclosed and patched multiple NGINX vulnerabilities, including the high-severity `CVE-2026-32647` in `ngx_http_mp4_module`, which affects both **NGINX Open Source** and **NGINX Plus**. The flaw is an out-of-bounds read memory corruption issue triggered when NGINX processes a specially crafted MP4 file, allowing a local authenticated attacker to crash worker processes in the data plane and potentially achieve arbitrary code execution. F5 said the control plane is not affected and credited Xint Code and Pavel Kohout of Aisle Research with the discovery and coordinated disclosure. The vulnerable condition impacts deployments using the `mp4` directive with `ngx_http_mp4_module` enabled; the module is included by default in NGINX Plus, while NGINX Open Source requires it to be explicitly compiled and enabled. F5 also published advisories for `CVE-2026-27654` in `ngx_http_dav_module` and `CVE-2026-28755` in `ngx_stream_ssl_module`, indicating a broader set of NGINX fixes released together. The company issued patched versions for affected NGINX Plus and Open Source releases and advised organizations that cannot patch immediately to disable the MP4 module and limit media publishing to trusted users.
Jun 29, 2026