What We Do
How We Do
Get Started
Security advisories

PHP Vulnerability Exploited (CVE-2024-4577)

June 11, 2024 | 2 MINS READ

Speak With A Security Expert Now



On June 6th, DEVCORE disclosed a critical vulnerability in PHP on the Windows operating system. The vulnerability, tracked as CVE-2024-4577 (CVSS: 9.8), is a Remote Code Execution (RCE) vulnerability. Exploitation would allow a remote and unauthenticated threat actor to reveal the source code of scripts and run arbitrary code on vulnerable servers.

Proof-of-Concept (PoC) exploit code was publicly released only one day after the vulnerability was disclosed. Additionally, attacks exploiting the vulnerability have now been confirmed, with at least one ransomware group exploiting CVE-2024-4577 for initial access into victim organizations.

As exploitation is ongoing, it is critical that organizations immediately apply the relevant security patches to minimize the likelihood of impact.

What we’re doing about it

What you should do about it

Additional information

CVE-2024-4577 is due to the “Best-Fit” feature used within Windows operating system. The Best-Fit feature allows the replacement of characters in a command line; this may be abused by threat actors to pass options to PHP binary being run, leading to malicious outcomes.

The earliest identified real-world attacks have been traced back to June 7th. It is believed that multiple threat actor groups are already exploiting the recently released vulnerability. The availability of PoC exploit code significantly simplifies the attack process and enables even low skilled actors to take advantage of the vulnerability.

According to the company Imperva, the TellYouThePass ransomware group is exploiting CVE-2024-4577 to execute PHP code on the victim system and to run an HTML application file. The file contained a VBScript, which in turn resulted in the deployment of a .NET variant of TellYouThePass ransomware. This ransomware group is not sophisticated, but they have a track record of rapidly adopting public exploits for new vulnerabilities to enable victim compromise; past examples include CVE-2021-44228 (Log4j) and CVE-2023-46604.

TellYouThePass previously leveraging the Log4j vulnerability demonstrates how threat actors exploit widely publicized vulnerabilities to maximize impact, highlighting the importance of patch management. An effective patch management strategy can significantly mitigate the risk of one-day vulnerabilities. By promptly addressing security flaws, organizations can reduce their attack surface and prevent exploitation.


[1] https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-4577
[3] https://www.imperva.com/blog/update-cve-2024-4577-quickly-weaponized-to-distribute-tellyouthepass-ransomware/
[4] https://www.esentire.com/security-advisories/critical-apache-zero-day-vulnerability

View Most Recent Advisories