CVE-2024-4577Vulnerability

PHP-CGI OS Command Injection Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 12 Jun 2024.

Reported by 8 independent sources · first reported 7 Mar 2025 by GreyNoise · last reported 22 Oct 2026

Last reported 2 days ago

CISA KEVAdded 12 Jun 2024
Fix due 3 Jul 2024
Used by ransomware: knownCISA KEV catalogue

EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 3 Oct 2026

What the reports say

10 reports, newest first · the exact sentence from each

“…empts against five vulnerabilities -- PHPUnit (CVE-2017-9841), XWiki (CVE-2025-24893), Apache HTTP Server (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79.145 (Hong Kong), 211.20.144.116 (Taiwan), and 210.242.76.32 (Taiwan).”

The Hacker NewsNews22 Oct 2026
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
“Attackers could move within minutes, because published fixes show where the bugs are.When CVE-2024-4577, a flaw in PHP’s Common Gateway Interface (CGI) mode on Windows, became public in June 2024, Akamai saw exploit attempts against its honeypots within 24 hours.”

SOCRadarVendor21 Oct 2026
PHP2Shell: CVE-2026-109618 & CVE-2026-109619
“When CVE-2024-4577, which affected PHP running in CGI mode on Windows, became public in June 2024, Akamai reported exploit attempts against its honeypot servers within 24 hours.”

Security AffairsNews21 Oct 2026
PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws
“The third, CVE-2012-1823, is a PHP-CGI flaw that CVE-2024-4577 later bypassed.”

TenableVendor21 Oct 2026
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
“For comparison, when CVE-2024-4577, a PHP flaw in CGI mode on Windows, became public in June 2024, Akamai saw exploit attempts against its honeypot servers within 24 hours.”

The Hacker NewsNews21 Oct 2026
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
“CVE-2024-4577, a critical PHP-CGI argument injection flaw”

CybleVendor14 Oct 2026
The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws
“CVE-2024-4577”

Recorded FutureVendor8 Sep 2026
August 2026 CVE Landscape
“CVE-2024-4577: PHP.CGI.Argument.Injection”

Fortinet Threat ResearchVendor13 Aug 2026
Multi-Functional Linux Botnet “Evooo1Bot”
“The query below captures a range of attempts (ThinkPHP, PHP CGI, PHPUnit, the recent PHP CVE-2024-4577, etc.), and the telemetry shows seven distinct attack patterns that move in parallel: steady in August–September, then spiking into October and November.”

GreyNoiseVendor4 Nov 2025
PHP Cryptomining Campaign: October/November 2025
“GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign”

GreyNoiseVendor7 Mar 2025
GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign

Indicators reported together

named in the same reports

Also named with it: CVE-2026-109618, CVE-2026-109619, CVE-2026-63030, CVE-2026-9198, CVE-2025-68613, CVE-2022-47945, CVE-2012-1823, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300, CVE-2026-33017, CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, CVE-2019-12263, CVE-2017-0199

Thanks — we review every report.

Report a wrong value