In PHP-FPM, the FastCGI process manager included with PHP since version 5.3, a critical vulnerability CVE-2021-21703 has been identified, allowing an unprivileged hosting user to execute code with root privileges. The issue occurs on servers using PHP-FPM to run PHP scripts, commonly paired with Nginx. Researchers who uncovered the problem were able to prepare a working exploit prototype.
