did I skim this correctly that with the mitigation shared this does not (yet) impact fpm-usage and classic CGI (vs. mod_php) is not impacted either?

▲

Maxious 3 hours ago | parent | next [-]

No, every platform affected.

> Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

https://www.php.net/archive/2026.php#2026-10-21-5

▲

CodesInChaos 2 hours ago | parent [-]

I'm surprised by CGI. The vulnerability description talks about a second request being affected by corrupted state from an earlier request. But I thought CGI only processes one request per process?

	▲	bombcar 31 minutes ago \| parent [-]
		Iirc one of the main performance tricks for CGI was to get processes to stay alive. But there were two vulns - only the second required the two requests.

▲

DDerTyp 3 hours ago | parent | prev [-]

[dead]