Loading story…
A critical remote code execution vulnerability in PHP on Windows, tracked as CVE-2024-4577, allows argument injection in PHP-CGI through Windows Best-Fit character encoding conversion. The flaw affects supported and unsupported PHP 5.x+ versions and is especially dangerous in CGI deployments where php-cgi.exe or php.exe is exposed to the web, including common default XAMPP-style configurations. Researchers reported that specially crafted HTTP requests can bypass prior protections and achieve remote code execution without authentication.
Security updates were released in PHP 8.3.8, 8.2.20, and 8.1.29, but exploitation began rapidly after disclosure. Multiple reports said attackers were using crafted POST requests to launch mshta.exe, retrieve a malicious HTA payload, and execute TellYouThePass ransomware via in-memory VBScript loading. Defenders were urged to patch immediately and, where patching was not yet possible, restrict or disable PHP-CGI exposure and apply web-server filtering and configuration mitigations to block exploit requests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
watchTowr Labs published a detailed analysis of CVE-2024-4577, further documenting the vulnerability and exploitation mechanics of the PHP issue.
PHP developers released fixes for CVE-2024-4577 in supported branches, with CSIRT.SK identifying patched versions as 8.3.8, 8.2.20, and 8.1.29. The updates addressed a critical Windows PHP-CGI remote code execution issue affecting supported and unsupported 5.x+ versions.
Multiple sources reported active in-the-wild exploitation of CVE-2024-4577 to deliver TellYouThePass ransomware. CSIRT.SK described crafted HTTP POST requests triggering mshta.exe to run a malicious HTA file that decodes and loads malware into memory.
DEVCORE published a security alert describing CVE-2024-4577, a PHP-CGI argument injection vulnerability on Windows caused by Best-Fit character encoding conversion that can lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourceimperva.com
Open sourcelabs.watchtowr.com
Open sourcedevco.re
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New CVE records document two high-severity web application vulnerabilities affecting **ThinkPHP 5.0.23** and **Ask Expert Script 3.0.5**. `CVE-2018-25270` describes an unauthenticated remote code execution flaw in ThinkPHP in which attackers can invoke functions through the routing parameter and send crafted requests to `index.php` to execute arbitrary PHP code. The issue is rated high impact across confidentiality, integrity, and availability under CVSS v3.1 and is referenced by public advisories and an Exploit-DB proof of concept. A separate entry, `CVE-2019-25676`, affects Ask Expert Script 3.0.5 and combines unauthenticated **cross-site scripting** and **SQL injection** weaknesses exposed through URL parameters. According to the record, attackers can inject script tags via the `cateid` parameter in `categorysearch.php` and inject SQL through the `view` parameter in `list-details.php`, potentially enabling browser-side code execution and database data extraction. The CVE maps the flaws to `CWE-79` and includes vendor, advisory, and exploit references, underscoring continued risk from exposed legacy PHP applications.
Jun 29, 2026
PHP disclosed fixes for two high-severity vulnerabilities affecting multiple supported branches. `CVE-2026-17543` is an SQL injection flaw in `ext-pgsql` caused by improper escaping of backslashes in attacker-controlled parameters, enabling trivial injection through `E'...'` breakout. `CVE-2026-17544` is an out-of-bounds write in `ext-bcmath` where crafted input to `bccomp()` can trigger stack and heap corruption. Both issues are rated as network-exploitable with low attack complexity and high impact on confidentiality, integrity, and availability, and CISA SSVC metadata indicates no exploitation has been observed but both flaws are considered automatable with total technical impact. The vulnerabilities affect PHP versions before `8.2.33`, `8.3.33`, `8.4.24`, and `8.5.9`, with the `bccomp()` flaw applying to `8.4.x` and `8.5.x` before those patched releases. The Canadian Centre for Cyber Security published advisory `AV26-764`, echoing the PHP Group notice and urging users and administrators to review the vendor guidance and update affected deployments as fixes become available.
Jul 31, 2026
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026