CVE-2014-0185: sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 u...

Security readout for executives and security teams

PHP-FPM could create its local FastCGI UNIX socket with permissions that allowed any local user to connect. On affected hosts, a low-privileged account could potentially act through PHP-FPM and gain privileges tied to that service. Exposure is most likely on legacy PHP-FPM 5.4 or 5.5 deployments using UNIX sockets, especially shared hosting, multi-user servers, or systems where untrusted local users exist. Treat this as high priority where legacy PHP-FPM remains in production or shared hosting is present. Single-tenant systems without local users are less exposed but should still be upgraded because the affected PHP branches are old. Mitigation focus: Upgrade PHP-FPM to 5.4.28, 5.5.12, or a vendor-supported fixed build.; Set PHP-FPM UNIX socket permissions to restrict access, consistent with vendor guidance.; Limit socket owner and group to the intended web server and PHP-FPM users..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.