Case: PHP-FPM Pool Separation Contained a Single-Site Breach

Case: PHP-FPM Pool Separation Contained a Single-Site Breach
Shared box ran 6 WordPress sites under one PHP-FPM pool, one Linux user. One compromised site let the attacker read all 6 wp-config.php files.

Isolation SOP:

— Step 1: Create a dedicated Linux user per site.
— Step 2: One FPM pool per site, each running as its own user.
— Step 3: open_basedir per pool, pinned to that site's docroot.
— Step 4: Set docroot ownership so other site users have no read access.
— Step 5: Re-test: from site A's user, attempt to read site B's config — expect denied.

Outcome: Cross-site file reads went from 6 sites exposed to 1. The next compromise (an old contact-form plugin) was contained to a single user with zero lateral movement.

Run this every time.