PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-4577] Critical RCE vulnerability in PHP CGI: everything you need to know

wiz.io | vulnerability | CVE-2024-4577 | #rce | #php | #ransomware | #vulnerability | #patching | #cve-2024-4577
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz explains CVE-2024-4577, a critical argument-injection RCE in Windows PHP CGI, and reports TellYouThePass ransomware exploiting it within days; patched versions and mitigations are covered.
CVE
CVE-2024-4577
Published
Collected

Related coverage

vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · wiz.io
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
vulnerability · aikido.dev
What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
# What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) Written by Willem Delbare Published on: Oct 21, 2026 **Update, 15:00 CEST: Patches are...
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · hunt.io
Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)
Two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, leaked pre-patch. We map the exposed PHP footprint and hunt open directories for exploitation.
Back