NEWS

Addressing the PHP-FPM Vulnerability (CVE-2019-11043) with NGINX A recently reported vulnerability, tracked as CVE-2019-11043, can affect websites that use PHP‑FPM to execute PHP pages. PHP‑FPM usage is particularly common at NGINX‑powered websites because NGINX does not have an in‑process PHP runtime. Instead, NGINX acts as a reverse proxy for application servers and process managers such as PHP‑FPM. The vulnerability lies in PHP‑FPM itself, not NGINX, so the only guaranteed solution is to upgrade to the patched release (or later) of your PHP version: PHP 7.1.33, PHP 7.2.24, or PHP 7.3.11. What Is the Nature of the Vulnerability? NGINX communicates with PHP‑FPM using the FastCGI protocol. Each FastCGI message contains a set of environment variables. One of these, PATH_INFO, is derived from other request parameters. If its value is unexpectedly empty, this can ultimately cause memory corruption in the PHP‑FPM binary. It is possible [ more… ]

APIs Need Secure and Scalable Delivery Too Most discussions of application delivery focus on traditional web‑based applications. Enterprises create web apps (or purchase them from third parties) and deploy them on their websites behind a human‑friendly UI layer so that customers can access goods and services via a browser or mobile device anytime and from anywhere. It’s well‑established that flawless delivery of web apps is critical to a company’s success. Less often discussed is the importance of providing flawless access to application programming interfaces (APIs), which enable applications to communicate directly with one another. Indeed APIs actually underlie much of the traffic on the Internet – when the human user accesses a website, his or her web browser actually makes calls to the web app’s API to request the assets needed to build the web page. Like web apps, many systems [ more… ]