* https://bugs.php.net/bug.php?id=81026
* https://www.ambionics.io/blog/php-fpm-local-root
* https://lists.debian.org/debian-security-announce/2021/msg00177.html
* Patch: https://github.com/php/php-src/commit/cb2021e5f69da5e2868130a05bb53db0f9f89e4b
We do run the master as root and are therefore affected:
```
legoktm@mw1430:~$ ps faux | grep fpm
root 12716 0.0 0.0 7402680 49808 ? S<s Oct20 0:25 php-fpm: master process (/etc/php/7.2/fpm/php-fpm.conf)
www-data 17881 10.5 3.5 8238884 3540912 ? S<l Oct24 182:42 \_ php-fpm: pool www
www-data 14363 10.2 3.6 8171456 3568268 ? S<l Oct24 177:02 \_ php-fpm: pool www
www-data 13638 10.3 3.6 8165012 3553316 ? R<l Oct24 179:15 \_ php-fpm: pool www
www-data 29854 10.2 3.6 8168904 3554264 ? S<l Oct24 175:22 \_ php-fpm: pool www
...
```
I already rebuilt the 7.4 packages, but we need to get a patch for 7.2 and roll it out.