VulnSocial

CVE-2019-11043PoC(canonical / debian_linux)

HIGHCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch canonical debian_linux systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

canonical CVEsBack to dashboard
6.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-04-15. Apply updates per vendor instructions.

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-120CWE-787

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • debian_linux
  • enterprise_linux
  • enterprise_linux_desktop
  • enterprise_linux_eus

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 3 observed days

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-08-25); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
canonicaldebianfedoraprojectphpredhattenable
Products
debian_linuxenterprise_linuxenterprise_linux_desktopenterprise_linux_eusenterprise_linux_eus_compute_nodeenterprise_linux_for_arm_64enterprise_linux_for_arm_64_eusenterprise_linux_for_ibm_z_systemsenterprise_linux_for_ibm_z_systems_eusenterprise_linux_for_power_big_endian

47 versions affected across 23 products

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-12: 1Mentions · 2026-08-25: 2Mentions · 2026-08-28: 1PoC Mentioned / Linked · 2026-07-12: 1Active Exploitation · 2026-08-28: 1Patch / Workaround · 2026-08-25: 1Technical Details · 2026-07-12: 1Technical Details · 2026-08-25: 2Technical Details · 2026-08-28: 107-1208-2508-28
Signal classification4 categories
PoC
125.0%
General
125.0%
Patch
125.0%
Active Exploitation
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-121
PoC1
2026-08-252
General1Patch1
2026-08-281
Active Exploitation1
Full discourse4 posts
  • pdnuclei-bot@pdnuclei_bot
    General

    🚨 CVE-2019-11043 - critical 🚨 PHP-FPM Path Info Buffer Underflow - Remote Code Execution > In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed... 👾 https://cloud.projectdiscovery.io/library/CVE-2019-11043 @pdnuclei #NucleiTemplates #cve

    Post summary

    The post announces the critical CVE‑2019‑11043 affecting PHP‑FPM, lists affected versions, and supplies a link for more details, but does not provide PoC, exploit code, patch, or evidence of active exploitation.

    0403251.4K
    1.3K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 CVE-2019-11043 — PHP-FPM Remote Code Execution PHP-FPM'de bulunan Path Info Buffer Underflow zafiyeti, belirli Nginx + PHP-FPM yapılandırmalarında uzaktan kod çalıştırılmasına (RCE) neden olabiliyor. Zafiyet, özel hazırlanmış HTTP istekleriyle PATH_INFO işlenmesi sırasında PHP-FPM'in bellek alanının sınırları dışına yazılmasına yol açabiliyor. PHP 7.1.33, 7.2.24 ve 7.3.11 öncesi sürümler etkileniyor. 🛡️ Çözüm: Etkilenen PHP sürümlerini güvenlik güncellemeleri içeren sürümlere yükseltmek. Nginx yapılandırmasında fastcgi_split_path_info kullanımı da kontrol edilmeli.

    Post summary

    The post details the path‑info buffer underflow CVE‑2019‑11043 that causes RCE on specific PHP‑FPM versions, and advises upgrading to patched PHP releases and reviewing nginx fastcgi_split_path_info settings.

    110781.4K
    2.4K followersView on X
  • r0otk3r@r0otk3r
    PoC

    🚨 CVE-2019-11043: Critical 9.8 CVSS PHP-FPM Remote Code Execution https://www.youtube.com/watch?v=cPUVsX9qmA8 #Cybersecurity #Infosec #AppSec #RCE #PHP #PHPFPM #Nginx #Envoy #CVE201911043 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/rhAbMHFGmy

    Post summary

    The tweet announces a critical PHP‑FPM RCE with a high CVSS score, links to a YouTube video likely containing a proof of concept, but provides no exploit code, evidence of active use, or specific patch details.

    0001050
    43 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers exploited critical PHP vulnerabilities (CVE-2018-19518, CVE-2019-11043) in internet-exposed Fuel-Boss industrial control systems to achieve remote code execution and privilege escalation. Post-compromise lateral movement across industrial network segments demonstrates how ICS breaches can expand beyond initial systems. Runtime segmentation limits blast radius in these environments. #CloudSecurity :link: Full TRC analysis: https://aviatrix.ai/threat-research-center/all-line-equipment-fuel-boss-cve-2018-19518-cve-2019-11043-2026

    Post summary

    The text reports real‑world exploitation of two PHP CVEs in Fuel‑Boss industrial control systems, highlighting remote code execution and lateral movement.

    0000048
    2.0K followersView on X
CPE platform detail64 entries

64 of 64 entries

PartVendorProductVersionTarget SWTarget HW
OScanonicalubuntu_linux12.04--
OScanonicalubuntu_linux14.04--
OScanonicalubuntu_linux16.04--
OScanonicalubuntu_linux18.04--
OScanonicalubuntu_linux19.04--
OScanonicalubuntu_linux19.10--
OSdebiandebian_linux10.0--
OSdebiandebian_linux9.0--
OSfedoraprojectfedora29--
OSfedoraprojectfedora30--
OSfedoraprojectfedora31--
Appphpphp---
OSredhatenterprise_linux8.0--
OSredhatenterprise_linux_desktop6.0--
OSredhatenterprise_linux_desktop7.0--
OSredhatenterprise_linux_eus7.7--
OSredhatenterprise_linux_eus8.1--
OSredhatenterprise_linux_eus8.2--
OSredhatenterprise_linux_eus8.4--
OSredhatenterprise_linux_eus8.6--
OSredhatenterprise_linux_eus8.8--
OSredhatenterprise_linux_eus_compute_node7.7--
OSredhatenterprise_linux_for_arm_648.0_aarch64--
OSredhatenterprise_linux_for_arm_64_eus8.1_aarch64--
OSredhatenterprise_linux_for_arm_64_eus8.2_aarch64--
OSredhatenterprise_linux_for_arm_64_eus8.4_aarch64--
OSredhatenterprise_linux_for_arm_64_eus8.6_aarch64--
OSredhatenterprise_linux_for_arm_64_eus8.8_aarch64--
OSredhatenterprise_linux_for_ibm_z_systems6.0_s390x--
OSredhatenterprise_linux_for_ibm_z_systems7.0_s390x--
OSredhatenterprise_linux_for_ibm_z_systems8.0_s390x--
OSredhatenterprise_linux_for_ibm_z_systems_eus7.7_s390x--
OSredhatenterprise_linux_for_ibm_z_systems_eus8.1_s390x--
OSredhatenterprise_linux_for_ibm_z_systems_eus8.2_s390x--
OSredhatenterprise_linux_for_ibm_z_systems_eus8.4_s390x--
OSredhatenterprise_linux_for_ibm_z_systems_eus8.6_s390x--
OSredhatenterprise_linux_for_ibm_z_systems_eus8.8_s390x--
OSredhatenterprise_linux_for_power_big_endian6.0_ppc64--
OSredhatenterprise_linux_for_power_big_endian7.0_ppc64--
OSredhatenterprise_linux_for_power_big_endian_eus7.7_ppc64--
OSredhatenterprise_linux_for_power_little_endian7.0_ppc64le--
OSredhatenterprise_linux_for_power_little_endian8.0_ppc64le--
OSredhatenterprise_linux_for_power_little_endian_eus7.7_ppc64le--
OSredhatenterprise_linux_for_power_little_endian_eus8.1_ppc64le--
OSredhatenterprise_linux_for_power_little_endian_eus8.2_ppc64le--
OSredhatenterprise_linux_for_power_little_endian_eus8.4_ppc64le--
OSredhatenterprise_linux_for_power_little_endian_eus8.6_ppc64le--
OSredhatenterprise_linux_for_power_little_endian_eus8.8_ppc64le--
OSredhatenterprise_linux_for_scientific_computing7.0--
OSredhatenterprise_linux_server6.0--
OSredhatenterprise_linux_server7.0--
OSredhatenterprise_linux_server_aus7.7--
OSredhatenterprise_linux_server_aus8.2--
OSredhatenterprise_linux_server_aus8.4--
OSredhatenterprise_linux_server_aus8.6--
OSredhatenterprise_linux_server_tus7.7--
OSredhatenterprise_linux_server_tus8.2--
OSredhatenterprise_linux_server_tus8.4--
OSredhatenterprise_linux_server_tus8.6--
OSredhatenterprise_linux_server_tus8.8--
OSredhatenterprise_linux_workstation6.0--
OSredhatenterprise_linux_workstation7.0--
Appredhatsoftware_collections1.0--
Apptenabletenable.sc---

Explore more

Back to dashboardcanonical CVEsdebian CVEsfedoraproject CVEsdebian_linux vulnerabilities