{
  "port": 9000,
  "protocol": "tcp",
  "service": "PHP-FPM, ClickHouse native protocol",
  "oneLiner": "A heavily overloaded port: PHP-FPM's FastCGI socket, ClickHouse's native protocol, and several self-hosted consoles.",
  "whatItIs": "IANA registers 9000 as cslistener, but you will meet it as PHP-FPM listening for FastCGI (`listen = 127.0.0.1:9000`) or as ClickHouse's native client/server protocol. Several self-hosted tools also default here, so identify the service before assuming. PHP-FPM is the dangerous case: the protocol is FastCGI, not HTTP, so a browser gets nothing while an attacker gets code execution.",
  "exposure": {
    "verdict": "never",
    "note": "PHP's own manual states an exposed FastCGI endpoint allows arbitrary code execution, and listen.allowed_clients is unset by default."
  },
  "checkCommand": "sudo lsof -nP -iTCP:9000 -sTCP:LISTEN",
  "links": [
    {
      "title": "PHP Manual — FPM configuration (listen, listen.allowed_clients warning)",
      "url": "https://www.php.net/manual/en/install.fpm.configuration.php",
      "kind": "official-docs"
    },
    {
      "title": "ClickHouse — Network ports (9000 native protocol)",
      "url": "https://clickhouse.com/docs/guides/sre/network-ports",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 9000",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9000",
      "kind": "iana"
    }
  ],
  "ianaName": "cslistener"
}