PHP is one of the most commonly used programming languages on the planet. As you know it is a programming language originally designed for use in web-based applications with HTML content.
PHP powers 78.4% of the web, including popular content management systems like WordPress, Drupal, and Joomla. The main reason behind this is PHP’s open-source nature, lightweight structure, and developer-friendly yet powerful features.
Security researchers are warning that a PHP-FPM local privilege escalation vulnerability impacting PHP could put millions of websites at risk. The vulnerability allows the root FPM process to read/write at arbitrary locations using pointers located in the SHM (Shared memory), leading to a privilege escalation from www-data to root. And this has been present for 10 years.
Related: How to Configure Nginx to Work with PHP via PHP-FPM
What are the affected PHP versions? This is possible in PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP-FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users.
Just for your information, here’s the percentage of PHP versions being used worldwide as of July, 2021.
![PHP versions usage as of July, 2021](https://cdn.shortpixel.ai/spai/q_lossy+ret_img+to_auto/linuxiac.com/wp-content/uploads/2021/10/php-versions-usage-graph.png)
If you’re wondering if you are vulnerable, here’s the answer. If you are using Apache and PHP, you might be using PHP-FPM. To be sure, you need to check on your server if Apache runs PHP as a module or via PHP-FPM. However if you’re using NGINX and PHP, you are using PHP-FPM. Therefore you are vulnerable.
Luckily this vulnerability was fixed in PHP’s versions 8.0.12 and 7.4.25. So if you are running a version of PHP-FPM which is among those vulnerable, please update immediately to the highest version in your release branch.