Unverified50% confidenceSolutionExact time
Running PHP-FPM as a non-root user, restricting file access scope via open_basedir, and disabling unnecessary dangerous functions (such as eval and system) can shrink the blast radius after a successful exploitation.
1
Sources
50%
Confidence
Long-term
Relevance
10/22/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIf PHP-FPM's pool configuration item security.limit_extensions is set improperly, it may allow execution of non-PHP files, thereby worsening the impact of vulnerabilities.73% similarUnverifiedSecurity hardening measures for Agent sandboxes include running as a non-root user, mounting read-only file systems, disabling the network or restricting egress IP whitelists, setting execution timeouts, and using seccomp to filter dangerous system calls.72% similarUnverifiedIf PHP-FPM's listening socket is misconfigured (for example, listening on 0.0.0.0 with no access control), attackers may communicate directly with FPM and bypass the web server's security rules.71% similarUnverifiedEnabling dangerous-class access bypasses file isolation, and isolation, auditing, and permission control must be handled by the user before running untrusted code71% similarUnverifiedA secure data write process should first look up the user's real OpenID on the backend, then save it together with the data to prevent unauthorized writes.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1086193API
curl https://kongchang.com/api/v1/knowledge/claims/1086193MCP
get_claim(id=1086193)