CVE-2019-11043

Assessment

Certain PHP-FPM configurations in PHP 7.1 before 7.1.33, 7.2 before 7.2.24, and 7.3 before 7.3.11 permit a buffer overwrite that can enable remote code execution. The CVSS 3.1 score is 8.7, CISA KEV establishes known global exploitation and known ransomware-campaign use, and a public exploit-oriented template is reported.

Why it matters

• Network-reachable exploitation requires no privileges or user interaction under the supplied CVSS vector, although attack complexity is high.
• Successful exploitation can compromise confidentiality and integrity through remote code execution.
• KEV and ransomware-use status establish material global threat context, not VTP observation.

Evidence

1 record references and 3 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

Exposure depends on the specific FPM configuration and affected PHP version.

The supplied template's functional reliability and current use are not established.

No first-party activity evidence is supplied.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

Presence of affected PHP-FPM versions and vulnerable configurations.