News for hackers. Stuff that matters.
Re:PHP-FPM remote code execution bug exploited in the wild by thesorrow on Sunday October 27, 2019 @11:26AM (#21370288)
I'm sure a lot of PHP 7.0 installations are still in production and will not receive a patch...
Re:PHP-FPM remote code execution bug exploited in the wild by kijin on Sunday October 27, 2019 @11:32AM (#21370331)
They will receive a patch if they're using it on a Linux distro that is still supported (e.g. Ubuntu 16.04 LTS). How many people actually bother to run apt-get update && apt-get upgrade on their cloud servers or docker images is a different question, though.
Re:PHP-FPM remote code execution bug exploited in the wild by oefrha on Sunday October 27, 2019 @11:53AM (#21370502)
Probably a good idea to auto install security updates. At least that’s what I do on my servers.
Re:PHP-FPM remote code execution bug exploited in the wild by thinkingemote on Sunday October 27, 2019 @04:50PM (#21372304)
I think it's the default for several years now but I imagine it's not normal for a security update in PHP to restart an nginx process? Maybe it is.
Re:PHP-FPM remote code execution bug exploited in the wild by gallexme on Sunday October 27, 2019 @11:31AM (#21370322)
Yup, we run like 50 sites on php 5.3 atm and just 5 with 7+ php industry is weird and update shy in my experience... Atleast in Europe
Re:PHP-FPM remote code execution bug exploited in the wild by VvR-Ox on Monday October 28, 2019 @08:05AM (#21376121)
OMG! Don't you ever have problems with those sites? Not just security but speed is also something I'd consider.

It's time to upgrade if you want to stay secure: https://www.php.net/supported-versions.php

Re:PHP-FPM remote code execution bug exploited in the wild by smsm42 on Sunday October 27, 2019 @07:21PM (#21373117)
If you're using out-of-support version, you should either use a distro that backports patches or contract somebody to do the backports for you. Otherwise you're basically hanging a sign saying "please pwn me" on your site. This is true for any software, not just PHP (for PHP, most security fixes are actually not hard to backport, just somebody has to do it).
Re:PHP-FPM remote code execution bug exploited in the wild by kgersen75 on Sunday October 27, 2019 @11:52AM (#21370490)
The issue is PHP-FPM (FastCGI) only and it's vulnerable from outside only with nginx.

The vast majority of PHP 7.0 installations don't use FastGCI and don't use nginx but Apache simply because people used 'apt install php' (or 'yum install php') to install it.

So imho, the impact is very limited.

Re:PHP-FPM remote code execution bug exploited in the wild by cbg0 on Sunday October 27, 2019 @12:02PM (#21370551)
> The vast majority of PHP 7.0 installations don't use FastGCI and don't use nginx

Do you have a source for this?

Re:PHP-FPM remote code execution bug exploited in the wild by wolco on Sunday October 27, 2019 @12:37PM (#21370751)
Common approach is to serve static files with nginx and use apache / php_mod to process.

Why are you running php-fpm? Do you need to separate request's processes? The speed benefits of php-fpm are part of php 7 so using php_mod is faster now.

Re:PHP-FPM remote code execution bug exploited in the wild by cbg0 on Sunday October 27, 2019 @01:31PM (#21371114)
> Common approach is to serve static files with nginx and use apache / php_mod to process.

Not sure how common that really is, I've personally never set things up like that and just use nginx + php-fpm and don't know anyone that still uses apache with mod_php.

Re:PHP-FPM remote code execution bug exploited in the wild by snuxoll on Sunday October 27, 2019 @10:58PM (#21373884)
Plenty of stuff still uses it, unfortunately. Performance is pretty janky, I just moved a Mediawiki install from Apache+mod_php to Nginx+php-fpm as part of getting the site(s) on kubernetes and it’s tremendously better to work with and uses less memory due to not needing mpm_prefork.
Re:PHP-FPM remote code execution bug exploited in the wild by wolco on Sunday October 27, 2019 @02:13PM (#21371416)
We went from php_mod to php-fpm but we started moving back to php_mod after php 7 came out showing the benchmarks.
Re:PHP-FPM remote code execution bug exploited in the wild by larzang on Sunday October 27, 2019 @03:35PM (#21371863)
That's true for us as well with our legacy applications.

Our newer applications are using litespeed instead, and we've found it to be significantly better. You basically get the features of a nginx + apache + varnish stack in a single easily managed service and with better performance too.

Re:PHP-FPM remote code execution bug exploited in the wild by locusm on Sunday October 27, 2019 @09:44PM (#21373668)
I think its the default on Plesk installs
Re:PHP-FPM remote code execution bug exploited in the wild by oefrha on Sunday October 27, 2019 @01:22PM (#21371048)
> Why are you running php-fpm?

Because running just nginx is more convenient than nginx + Apache, where Apache is only used for mod_php. For me anyway. (I only use nginx + php-fpm for a Wordpress instance; I have tons of stuff in other languages running on top of nginx too.)

Re:PHP-FPM remote code execution bug exploited in the wild by stephenr on Sunday October 27, 2019 @01:58PM (#21371308)
Why are you not running php-fpm with Apache is a more pressing question IMO.
Re:PHP-FPM remote code execution bug exploited in the wild by wolco on Sunday October 27, 2019 @02:11PM (#21371403)
Speed mostly.
Re:PHP-FPM remote code execution bug exploited in the wild by maxymajzr on Sunday October 27, 2019 @03:43PM (#21371913)
Can you elaborate? I've yet to see Apache + mod_php to be capable of coming even close to <anything> + PHP-FPM so I'm really interested in what you guys are doing.
Re:PHP-FPM remote code execution bug exploited in the wild by NightlyDev on Sunday October 27, 2019 @04:58PM (#21372348)
Mod_php was always faster at executing scripts. There is less overhead as you don't have to communicate like you have to with fpm.

For light scripts this is far superior to fpm. On the other hand, always loading php does have it's downsides too as memory consumption can get quite high depending on the number of threads.

This is was also the reason for the fpm hype a long time ago: don't waste memory on php when php isn't needed. It had nothing to do with it running php faster.

What you should choose depends on your need.

Re:PHP-FPM remote code execution bug exploited in the wild by maxymajzr on Sunday November 03, 2019 @02:55PM (#21436155)
> Mod_php was always faster at executing scripts

I've never, ever witnessed that mod_php came close to be fast, let alone faster than PHP-FPM. There's more work to be done in order to prepare everything needed for Apache to pass the data to PHP executable once it embeds it within its own process. Once opcache is up and running, PHP-FPM blows mod_php away (and there are tools to warm up the cache prior to letting the php-fpm node go live).

> This is was also the reason for the fpm hype a long time ago: don't waste memory on php when php isn't needed

I've been present when the "hype" as you called it hit. It had nothing to do with memory as much as it did with scaling. Added benefit was the ability to have PHP-FPM act as a multiplexer towards certain services (database to name one).

Today, there's no reason to use Apache and mod_php. It's slower and worse by definition. It can't be faster. If you receive results that show it is faster, you're either testing it wrong or your PHP-FPM runs on a raspberry pi.

Re:PHP-FPM remote code execution bug exploited in the wild by mtbcoder on Monday October 28, 2019 @10:21AM (#21377244)
> Mod_php was always faster at executing scripts. There is less overhead as you don't have to communicate like you have to with fpm.

The "overhead" of communicating via CGI to a PHP process has nothing to do with the speed of execution of the script itself.

> For light scripts this is far superior to fpm. On the other hand, always loading php does have it's downsides too as memory consumption can get quite high depending on the number of threads.

It's not far superior as the "overhead" of CGI is negligible in the real world. Plus you can pool processes for better scaling. Also, if you are using prefork with mod_php (which is the most probable scenario) it means you are forking an entirely new Apache process and not just "loading PHP" with each request.

> This is was also the reason for the fpm hype a long time ago: don't waste memory on php when php isn't needed. It had nothing to do with it running php faster.

It's not hype, because for a long time, mod_php required prefork because it was not thread-safe (even now it's still a pain to manage re-compiling PHP to be thread-safe for mod_php + Apache)...which means you could not take advantage of mpm_event or mpm_worker.

Re:PHP-FPM remote code execution bug exploited in the wild by g8oz on Monday October 28, 2019 @02:00PM (#21379649)
Yes CGI just allows you to scale in a way mod_php doesn't. Apache & mod_fcgid are a great combo imo.
Re:PHP-FPM remote code execution bug exploited in the wild by stephenr on Monday October 28, 2019 @02:25PM (#21379972)
Have you tried mod_proxy_fcgi? Being able to have similar handling for fpm and other proxied appservers (eg ruby or python stuff) is quite handy.
Re:PHP-FPM remote code execution bug exploited in the wild by stephenr on Sunday October 27, 2019 @02:27PM (#21371518)
I was under the impression that a properly tuned mpm_event and fpm has very little difference to mpm_prefork and mod_php. What sort of machines are you running this on and what sort of child proc numbers are you running?
Re:PHP-FPM remote code execution bug exploited in the wild by shakna on Sunday October 27, 2019 @01:50PM (#21371245)
PHP-FPM + Nginx is the standard approach for OwnCloud & NextCloud. I'm sure they're not the only stacks that use that approach.