diff --git a/install/fpm/configuration.xml b/install/fpm/configuration.xml
index e33c099864ce..e2396d9482cd 100644
--- a/install/fpm/configuration.xml
+++ b/install/fpm/configuration.xml
@@ -251,6 +251,23 @@
         'ip.add.re.ss:port', 'port', '/path/to/unix/socket'. This option is
         mandatory for each pool.
        </para>
+       <warning>
+        <simpara>
+         An exposed FastCGI endpoint allows arbitrary code execution.
+         When the web server runs on the same host, a Unix socket should be
+         preferred; on Linux its access is then controlled by
+         <link linkend="listen-owner">listen.owner</link>,
+         <literal>listen.group</literal> and <literal>listen.mode</literal>,
+         although many BSD-derived systems accept connections regardless of
+         those permissions.
+         When a TCP socket is used, the addresses allowed to connect must be
+         listed in
+         <link linkend="listen-allowed-clients">listen.allowed_clients</link>,
+         which is unset by default and then accepts any address.
+         In container setups, the FPM service should not publish its port on
+         the host; containers on the same network reach each other directly.
+        </simpara>
+       </warning>
       </listitem>
      </varlistentry>
      <varlistentry xml:id="listen-backlog">
diff --git a/install/fpm/index.xml b/install/fpm/index.xml
index c4644a0e232e..f466595a00d8 100644
--- a/install/fpm/index.xml
+++ b/install/fpm/index.xml
@@ -41,11 +41,11 @@
       </para>
      </listitem>
      <listitem>
-      <para>
+      <simpara>
        <function>fastcgi_finish_request</function> - special function to finish
        request and flush all data while continuing to do something
        time-consuming (video converting, stats processing etc.);
-      </para>
+      </simpara>
      </listitem>
      <listitem>
       <para>
@@ -66,6 +66,20 @@
     </itemizedlist>
    </para>
    
+   <warning>
+    <simpara>
+     php-fpm must not be reachable from an untrusted network.
+     A client that can open a FastCGI connection controls the
+     configuration used for the request, including
+     <link linkend="ini.auto-prepend-file">auto_prepend_file</link>,
+     and can therefore execute arbitrary code.
+     Access is restricted through the
+     <link linkend="listen">listen</link> and
+     <link linkend="listen-allowed-clients">listen.allowed_clients</link>
+     directives.
+    </simpara>
+   </warning>
+
    &install.fpm.install;
    &install.fpm.configuration;
   </chapter>