9.8Critical KEV Used in ransomware

CVE-2024-4577Argument Injection in PHP-CGI

PHP Group PHP; php_group php Published: 2024-06-09 22:42 (2 years ago)

Known exploited — PHP-CGI OS Command Injection Vulnerability

CISA confirmed this vulnerability is used in real attacks on 12.06.2024. Remediation deadline for US federal agencies: 03.07.2024.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://www.php.net/ChangeLog-8.php#; https://nvd.nist.gov/vuln/detail/CVE-2024-4577

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Weakness (CWE): CWE-78

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
fedoraproject	fedora	39
PHP Group	PHP	8.1.* – < 8.1.29, 8.2.* – < 8.2.20, 8.3.* – < 8.3.8

References and patches

https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv ExploitThird Party Advisory
https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html Third Party Advisory
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ ExploitThird Party Advisory
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-… ExploitPress/Media CoverageThird Party Advisory
https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/ Third Party Advisory
https://github.com/11whoami99/CVE-2024-4577 Exploit
https://github.com/xcanwin/CVE-2024-4577-PHP-RCE ExploitThird Party Advisory
https://github.com/rapid7/metasploit-framework/pull/19247 ExploitIssue TrackingPatch
https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/ ExploitThird Party Advisory
https://github.com/watchtowrlabs/CVE-2024-4577 ExploitThird Party Advisory
https://www.php.net/ChangeLog-8.php#8.1.29 Release Notes
https://www.php.net/ChangeLog-8.php#8.2.20 Release Notes
https://www.php.net/ChangeLog-8.php#8.3.8 Release Notes
https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately Third Party Advisory
https://isc.sans.edu/diary/30994 ExploitThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/06/07/1 Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3R… Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRT… Mailing List
https://security.netapp.com/advisory/ntap-20240621-0008/ Third Party Advisory
https://blog.talosintelligence.com/new-persistent-attacks-japan/ ExploitThird Party Advisory
https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577 ExploitThird Party Advisory
https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577 ExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577 US Government Resource

CPE matches (NVD) (5)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.1.0 < 8.1.29
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.20
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.8
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

CVSS score

9.8Critical

Source: php · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (3)

cna	CVSS 3.1	9.8Critical
security@php.net	CVSS 3.1	9.8Critical
nvd	CVSS 3.1	9.8Critical

EPSS (chance of exploitation in 30 days)

99.99%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: total

Timeline

ID reserved2024-05-06
Published2024-06-09 22:42
Reached IP-DB2026-10-24 23:25
Added to KEV2024-06-12
Last updated2026-06-17 11:02

Assigned by (CNA): php
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — PHP

9.2Critical

CVE-2026-109619 KEV 22 days ago

RCE via stale global state

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS

9.2Critical

CVE-2026-109618 KEV 22 days ago

RCE via OOM corruption

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

100%EPSS

5.9Medium

CVE-2026-92842 1 month ago

OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

PHP Group PHP

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup…

6.5Medium

CVE-2026-91768 1 month ago

IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

PHP Group PHP

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with…

4.3Medium

CVE-2026-91769 1 month ago

TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP Group PHP

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certifi…

6.5Medium

CVE-2026-91767 1 month ago

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

PHP Group PHP

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious ser…