News for hackers. Stuff that matters.
Re:PHP-FPM remote code execution bug exploited in the wild by cbg0 on Sunday October 27, 2019 @01:31PM (#21371114)
> Common approach is to serve static files with nginx and use apache / php_mod to process.

Not sure how common that really is, I've personally never set things up like that and just use nginx + php-fpm and don't know anyone that still uses apache with mod_php.

Re:PHP-FPM remote code execution bug exploited in the wild by snuxoll on Sunday October 27, 2019 @10:58PM (#21373884)
Plenty of stuff still uses it, unfortunately. Performance is pretty janky, I just moved a Mediawiki install from Apache+mod_php to Nginx+php-fpm as part of getting the site(s) on kubernetes and it’s tremendously better to work with and uses less memory due to not needing mpm_prefork.
Re:PHP-FPM remote code execution bug exploited in the wild by wolco on Sunday October 27, 2019 @02:13PM (#21371416)
We went from php_mod to php-fpm but we started moving back to php_mod after php 7 came out showing the benchmarks.
Re:PHP-FPM remote code execution bug exploited in the wild by larzang on Sunday October 27, 2019 @03:35PM (#21371863)
That's true for us as well with our legacy applications.

Our newer applications are using litespeed instead, and we've found it to be significantly better. You basically get the features of a nginx + apache + varnish stack in a single easily managed service and with better performance too.

Re:PHP-FPM remote code execution bug exploited in the wild by locusm on Sunday October 27, 2019 @09:44PM (#21373668)
I think its the default on Plesk installs