On Thu, 2026-10-22 at 09:32 -0700, Adam Williamson wrote: > > matter at all, if one component i.e. php-fpm out of 4 > > use-cases -> "cgi,cli,fpm,mod_php" is safe, the rest is not. > > The PHP post says "all PHP installations serving web requests, > including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and > LiteSpeed. We consider the risk highest for mod_php, with a > demonstrated exploit where an unauthenticated request can trigger the > attack before any application code runs." This implies that there is > *not* a demonstrated RCE exploit for mod_php or php-cgi.
Gah - I meant "This implies that there is *not* a demonstrated pre-auth RCE exploit for php-fpm or php-cgi (etc.)" -- Adam Williamson (he/him/his) Fedora QA Fedora Chat: @adamwill:fedora.im | Mastodon: @[email protected] https://www.happyassassin.net -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
