CVE-2019-11043

CVE-2019-11043 is a buffer overflow (CWE-120/CWE-787) in PHP's FastCGI Process Manager (PHP-FPM) affecting PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. In certain FPM configurations — commonly web servers such as nginx that split PATH_INFO via fastcgi_split_path_info without validating that the requested PHP script exists — an unauthenticated remote attacker can send a crafted request that makes PHP-FPM write past allocated buffers into the space reserved for FCGI protocol data. This corruption of the FastCGI protocol state allows the attacker to execute arbitrary code with the privileges of the PHP-FPM worker on the hosting web server. Anyone running a vulnerable PHP-FPM behind an affected configuration is exposed, including Linux distribution packages (Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Red Hat Software Collections), Tenable.sc deployments, and QNAP NAS devices running vulnerable PHP. The flaw is being actively exploited in the wild — it is in CISA's KEV with known ransomware use (including campaigns such as NextCry targeting Nextcloud instances on Linux servers) — and a public proof-of-concept exploit exists, consistent with its 99.8% EPSS score.

What to do: Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later (or apply your distribution's/vendor's patched packages — CISA's KEV required action is to apply updates per vendor instructions; QNAP users should apply QNAP's released updates). As an interim mitigation, harden the nginx fastcgi_split_path_info configuration (prefix the regex with '^' and use try_files to confirm the script exists) or disable PATH_INFO where it is not needed. Prioritize internet-facing web servers, shared hosting, and QNAP/Nextcloud instances for patching and check them for compromise, given active ransomware exploitation.