CVE-2024-4577 KEVRansomwarePublic exploit Critical · 9.8 EPSS >99.9%
PHP-CGI OS Command Injection Vulnerability
PHP Group · PHP
Summary
The PHP-CGI module in PHP versions 8.1.x before 8.1.29, 8.2.x before 8.2.20, and 8.3.x before 8.3.8 is flawed when Apache and PHP-CGI run on Windows with certain code pages configured. Windows "Best-Fit" character replacement in command lines passed to Win32 API functions can cause PHP-CGI to misread those characters as PHP options, which can let a remote, unauthenticated attacker pass options to the PHP binary and potentially reveal script source code or run arbitrary PHP code on the server, with no user interaction required.
Official description · NVD
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
79.9 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 10/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
- Schedule tasks to run malwareT1053 · Scheduled Task/Job
- Change the Windows registryT1112 · Modify Registry
- Install a malicious serviceT1543 · Create or Modify System Process
- Gain administrator or root rightsT1068 · Exploitation for Privilege Escalation
- Dump stored passwords and hashesT1003 · OS Credential Dumping
- Dump passwords from Windows memoryT1003.001 · LSASS Memory
- System Owner/User DiscoveryT1033 · System Owner/User Discovery
- Copy tools between internal systemsT1570 · Lateral Tool Transfer
- Talk to the attacker over web trafficT1071.001 · Web Protocols
- Send stolen data out over the attacker’s channelT1041 · Exfiltration Over C2 Channel
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 days before it was disclosed. Public exploit code (Metasploit) was available 3 days before disclosure.
- Public exploit codeMetasploit3 days before
- First seen exploitedVulnCheck KEV evidence2 days before
- Disclosedday 0
- Added to CISA KEVknown ransomware use; EU database agrees+3 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
12 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 12Initial AccessTA0001
MITRE CTID mapping of the KEV entry · how it is exploited
CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.
ExecutionTA0002
MITRE CTID mapping of the KEV entry · follow-on activity
MITRE CTID mapping of the KEV entry · primary impact
PersistenceTA0003
MITRE CTID mapping of the KEV entry · follow-on activity
MITRE CTID mapping of the KEV entry · follow-on activity
Privilege EscalationTA0004
MITRE CTID mapping of the KEV entry · follow-on activity
Credential AccessTA0006
OS Credential Dumping T1003
MITRE CTID mapping of the KEV entry · follow-on activity
LSASS Memory T1003.001
MITRE CTID mapping of the KEV entry · follow-on activity
DiscoveryTA0007
MITRE CTID mapping of the KEV entry · follow-on activity
Lateral MovementTA0008
Lateral Tool Transfer T1570
MITRE CTID mapping of the KEV entry · follow-on activity
Command and ControlTA0011
Web Protocols T1071.001
MITRE CTID mapping of the KEV entry · follow-on activity
ExfiltrationTA0010
MITRE CTID mapping of the KEV entry · follow-on activity
Detection
0 rules for this CVE · 593 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2024-4577 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Scheduled Task/JobT105312 general rules
- HAFNIUM Exchange Exploitation Activitycriticaltest
- HackTool - CrackMapExec Execution Patternshighstable
- HackTool - CrackMapExec Executionhightest
- HackTool - SharPersist Executionhightest
- Potential ACTINIUM Persistence Activityhightest
- Remote Schedule Task Lateral Movement via ATSvchightest
- Remote Schedule Task Lateral Movement via ITaskSchedulerServicehightest
- Remote Schedule Task Lateral Movement via SASechightest
Modify RegistryT111298 general rules
- FlowCloud Registry Markerscriticaltest
- OceanLotus Registry Activitycriticaltest
- OilRig APT Activitycriticaltest
- OilRig APT Registry Persistencecriticaltest
- OilRig APT Schedule Task Persistence - Securitycriticaltest
- OilRig APT Schedule Task Persistence - Systemcriticaltest
- Registry Entries For Azorult Malwarecriticaltest
- ShimCache Flushhighstable
Create or Modify System ProcessT15439 general rules
- CodeIntegrity - Blocked Driver Load With Revoked Certificatehightest
- CodeIntegrity - Blocked Image/Driver Load For Policy Violationhightest
- KrbRelayUp Service Installationhightest
- PUA - Process Hacker Driver Loadhightest
- Service Installed By Unusual Client - Securityhightest
- Service Installed By Unusual Client - Systemhightest
- PUA - Process Hacker Executionmediumtest
- PUA - System Informer Driver Loadmediumtest
Exploitation for Privilege EscalationT106831 general rules
- Exploiting CVE-2019-1388criticalstable
- Audit CVE Eventcriticaltest
- HackTool - SysmonEOP Executioncriticaltest
- InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
- Possible Coin Miner CPU Priority Paramcriticaltest
- Potential CVE-2021-41379 Exploitation Attemptcriticaltest
- Potential SystemNightmare Exploitation Attemptcriticaltest
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest
OS Credential DumpingT100337 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Rubeus Executioncriticalstable
- Hacktool Execution - Imphashcriticaltest
- Potential Credential Dumping Via LSASS Process Clonecriticaltest
- WCE wceaux.dll Accesscriticaltest
- HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdumphightest
- HackTool - Rubeus Execution - ScriptBlockhightest
- Hacktool Execution - PE Metadatahightest
LSASS MemoryT1003.00179 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- APT31 Judgement Panda Activitycriticaltest
- HackTool - Credential Dumping Tools Named Pipe Createdcriticaltest
- HackTool - Dumpert Process Dumper Default Filecriticaltest
- HackTool - Dumpert Process Dumper Executioncriticaltest
- HackTool - Inveigh Executioncriticaltest
- HackTool - SafetyKatz Executioncriticaltest
- HackTool - Windows Credential Editor (WCE) Executioncriticaltest
System Owner/User DiscoveryT103330 general rules
- Potential Dridex Activitycriticalstable
- Renamed Whoami Executioncriticaltest
- Chopper Webshell Process Patternhightest
- HackTool - SharpLdapWhoami Executionhightest
- HackTool - SharpView Executionhightest
- Possible DCSync Attackhightest
- Security Privileges Enumeration Via Whoami.EXEhightest
- SharpHound Recon Sessionshightest
Lateral Tool TransferT15706 general rules
- Metasploit Or Impacket Service Installation Via SMB PsExechightest
- PSEXEC Remote Execution File Artefacthightest
- Rundll32 Execution Without Parametershightest
- SMB over QUIC Via Net.EXEmediumtest
- SMB over QUIC Via PowerShell Scriptmediumtest
- Potentially Suspicious File Creation by OpenEDR's ITSMServicemediumexperimental
Web ProtocolsT1071.00142 general rules
- Ursnif Malware C2 URL Patterncriticalstable
- HackTool - BabyShark Agent Default URL Patterncriticaltest
- PwnDrp Accesscriticaltest
- Ursnif Malware Download URL Patternhighstable
- APT User Agenthightest
- APT40 Dropbox Tool User Agenthightest
- Bitsadmin to Uncommon IP Server Addresshightest
- Bitsadmin to Uncommon TLDhightest
Exfiltration Over C2 ChannelT10415 general rules
- Equation Group C2 Communicationhightest
- OpenCanary - TFTP Requesthightest
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental
- Network Communication Initiated To Portmap.IO Domainmediumtest
- Tunneling Tool Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- TSEC Honeypot: Exploit Attempt - Week of 2026-10-1923 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- 44 more on OTX