Andreas Schnederle-Wagner

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 7.3.0alpha3 PHP versions prior to 7.2.8 PHP versions prior to 7.1.20 **Description** An issue was discovered where the php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., `passthru`, `exec`, `shell exec`, or `system`) with a non-blocking STDIN stream. This causes the master process to consume 100% of the CPU and generate a large volume of error logs, consuming disk space. An example of this issue was demonstrated by an attack on a customer of a shared-hosting facility. **Recommendations** For PHP versions prior to 7.3.0alpha3, update to version 7.3.0alpha3 or later to resolve the issue. For PHP versions prior to 7.2.8, update to version 7.2.8 or later to resolve the issue. For PHP versions prior to 7.1.20, update to version 7.1.20 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** phpGrid versions prior to 7.2.5 **Description** The issue allows remote attackers to execute arbitrary code by uploading a crafted file with a .. (dot dot) in the file name, exploiting a directory traversal vulnerability in the ajaxfileupload.php file. **Recommendations** For versions prior to 7.2.5, update to version 7.2.5 or later to resolve the issue.