PHP CVE-2024-4577 Command Injection Vulnerability

Description

Windows Best-Fit character replacement in command lines to Win32 APIs causes PHP-CGI on Apache to misinterpret options, letting attackers pass PHP options that expose source code or execute arbitrary PHP on PHP 8.1-8.3 on Windows.

Outbreak Alert

FortiGuard Labs has observed significant level of exploitation attempts targeting the new PHP vulnerability. The TellYouThePass ransomware gang has been leveraging CVE-2024-4577, a remote code execution vulnerability in PHP to deliver web shells and deploy ransomware on targeted systems.

View the full Outbreak Alert Report

Affected Applications

PHP

References