CVE-2024-4577 is a critical remote code execution vulnerability affecting the PHP runtime engine. It has been assigned a CVSS severity score of 9.8, indicating its high impact potential.
The vulnerability enables unauthenticated remote attackers to execute arbitrary system commands on Windows servers running PHP in CGI mode. Exploitation of this vulnerability was reported within 24 hours of its disclosure.
Attackers have used this vulnerability to establish persistent webshell backdoors on thousands of exposed enterprise servers. The root cause is linked to an unexpected interaction between PHP argument handling logic and Windows' Best-Fit mapping feature.
The PHP development team has responded by releasing emergency maintenance updates for all supported PHP branches, specifically PHP 8.3.8, PHP 8.2.20, and PHP 8.1.29. Systems administrators are executing emergency software updates to mitigate the vulnerability.
The vulnerability allows attackers to inject command-line arguments into the PHP-CGI executable. Security researchers identified that certain Windows locales can convert Unicode characters into local ANSI codepages, which can be exploited.