PHP-FPM

PHP FastCGI Process Manager

PHP's own process manager, which runs PHP code for a front end such as nginx.

Web and App Servers

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

App
Framework
Web ServerPHP-FPM
Runtime
Containers
OS
Hypervisor
Firmware
Hardware
Data

It Runs

PHP-FPMWeb and App Servers

Runs On

Behind

nginxWeb and App Servers

See It in the Stack

About

PHP-FPM is the part of PHP that runs it as its own service. It keeps pools of PHP worker processes and runs each script a front end hands over. The hand-over uses FastCGI, a standard way for a web server to pass a request to another program. Because nginx cannot run PHP itself, it passes PHP requests to PHP-FPM. That is the usual set-up for WordPress or Laravel on nginx, and Apache can use PHP-FPM in place of mod_php. It comes with PHP and usually runs on Linux.

How to Spot It

These are signs that a system runs PHP-FPM, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Default port: 9000 (FastCGI, bound to the machine itself in the default pool)
Status page, if switched on: process manager: dynamic
Ping page, if switched on: pong

If It Has a Flaw

PHP-FPM runs the PHP code of every site in its pools, so a flaw in it reaches all of them. Its FastCGI port is meant for the front end alone, because the PHP manual warns that anyone who can connect to it can make it run code.

A flaw exposes what runs on it and the data it reaches.

Application: WordPress
Framework and Libraries: Laravel
Data: MySQL

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where PHP-FPM sits.

CVE-2019-11043 (opens in a new tab)2019
PATH_INFO Underflow
With a common nginx set-up, a crafted web address made PHP-FPM write outside its buffer, which let attackers run code.
Reach Code run through it had the PHP-FPM workers' rights, reaching every site that pool served.

Rivals

Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach PHP-FPM.

Stacks and Code

PHP-FPM is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.

In Common Stacks: WordPress on nginx and PHP-FPM
Its Code Comes From: OS Packages