Comment by Maxious
9 hours ago
No, every platform affected.
> Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
9 hours ago
No, every platform affected.
> Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
I'm surprised by CGI. The vulnerability description talks about a second request being affected by corrupted state from an earlier request. But I thought CGI only processes one request per process?
Iirc one of the main performance tricks for CGI was to get processes to stay alive.
But there were two vulns - only the second required the two requests.