CVE-2012-1823Vulnerability
PHP-CGI Query String Parameter Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by GreyNoise · last reported
Last reported 3 days ago
CISA KEVAdded 25 Mar 2022
Fix due 15 Apr 2022
Used by ransomware: not knownCISA KEV catalogue
Fix due 15 Apr 2022
Used by ransomware: not knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 16 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 16 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities“The third, CVE-2012-1823, is a PHP-CGI flaw that CVE-2024-4577 later bypassed.”
-
PHP Cryptomining Campaign: October/November 2025“The loudest campaigns exploit ThinkPHP Framework LFI (CVE-2022-47945), PHP CGI (CVE-2012-1823), and PHP CVE-2024-4577, all of which show steep growth.”
Indicators reported together
named in the same reports- calif[.]ioin 1 report
Copy this indicator · defanged
Also named with it: CVE-2024-4577, CVE-2019-9082, CVE-2022-47945, CVE-2026-109618, CVE-2026-109619
Thanks — we review every report.