I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?


1 Answer 1


FastCGI communicates between the webserver and the CGI host using IPC rather than environment variables, so the main attack vector (the webserver setting environment variables for CGI) is gone. However, it is still possible for you to be attacked if your PHP script itself sets environment variables based on user input before executing bash.

  • 2
    +1 seems ok to me. downvoter care to comment?
    – user10008
    Oct 7, 2014 at 4:38
  • Is there any reference that points out fast CGI is safe ?
    – Jake
    Oct 16, 2015 at 1:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .