CVE-2024-4577 explained: the PHP-CGI RCE attackers keep spraying

CVE-2024-4577 is an argument-injection flaw in PHP-CGI on Windows. It is the modern re-discovery of the classic CVE-2012-1823 php-cgi bug: by smuggling command-line switches like -d allow_url_include=on -d auto_prepend_file=php://input into the query string, an attacker can make PHP execute a payload sent in the request body. The result is unauthenticated remote code execution.

Why it is everywhere

It is trivial to test and trivial to weaponise, so it is one of the most-sprayed exploits on the internet. On our decoys we see canned probes that echo md5("Hello CVE-2024-4577"), the tell-tale proof-of-concept marker, alongside real payloads that pull a second-stage loader.

Is it a big deal for you?

It is network-detectable and on the CISA KEV list, which means it is being actively exploited. If you run PHP on Windows with Apache and mod_cgi, patch to a fixed PHP release now. If you do not, it is still worth knowing when your product type is being probed, because the same actors move on to whatever else you expose.

Watch it in the wild

Every CVE on huntback has a live page backed by our sensor network. See who is exploiting CVE-2024-4577 right now, the attempt count, distinct sources, and whether it is network-detectable. Or deploy a decoy that emulates your stack and see the exact payloads the moment they land.