CVE-2015-9253

What it actually does

The php-fpm master process enters an endless restart loop for child processes when execution functions (passthru, exec, shell_exec, system) are invoked with non-blocking STDIN, driving CPU to 100% and generating large volumes of error logs that consume disk space.

Why it matters to the business

Web services and shared-hosting environments experience sustained outages or severe slowdowns, increased operational costs for log cleanup, and potential loss of availability for customer sites until the affected PHP processes are restarted or the host is rebooted.

How an attack unfolds

An attacker with the ability to supply input that reaches program-execution functions in a PHP script running under php-fpm sends requests that force a non-blocking STDIN stream; the master process then loops indefinitely restarting the child, exhausting CPU and log storage.

How to fix it

Upgrade to PHP 7.1.20 or newer, 7.2.8 or newer, or 7.3.0alpha3 or newer. Where immediate upgrade is impossible, disable non-blocking STDIN usage in execution functions via application changes or apply OS-level CPU and log-size limits to the php-fpm master process.

How to confirm the fix worked

Verify the installed PHP version is at or above the fixed releases listed above; attempt to reproduce the non-blocking STDIN condition in a test environment and confirm the master process no longer loops.

Typical attack path

1. Locate a PHP application hosted under php-fpm that accepts attacker-controlled input to execution functions
2. Craft HTTP requests or other input that triggers passthru/exec/shell_exec/system with a non-blocking STDIN descriptor
3. Observe the php-fpm master process enter the restart loop, pegging CPU at 100% and rapidly writing error logs

How to detect it

Monitor php-fpm master process CPU and memory metrics; inspect php-fpm error logs for repeated child-process restart messages correlated with execution-function calls; correlate with web-server access logs showing requests that reach passthru/exec/shell_exec/system.

• php-fpm master process CPU at or near 100%
• repeated "child process.*restarting" messages in php-fpm error log
• large volumes of php-fpm error logs written in short time windows
• process name: php-fpm master

What your security team should do

• Prioritize upgrade of all php-fpm instances to a fixed PHP release
• Add monitoring alerts for php-fpm master CPU usage above 80% sustained and rapid growth of php-fpm error logs
• Review application code for direct or indirect calls to execution functions with untrusted input
• Apply resource limits (CPU, log rotation) to php-fpm as a defense-in-depth measure