VulnRadar

Data against noise.

Built with NaN
Page generated: 07 Nov 2026, 05:09 UTC
← Dashboard

CVE-2024-4577

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP C…

Read full description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
1.6/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 99.99%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 28 documents and public datasets.

Hype components

Headline sample (25%)
50/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
0/100
HYPE TOTAL16/100

Sources and documents

Tenable Blog
Press · 21 Oct 2026, 09:01 · php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
SOC Prime
Press · 30 Apr 2026, 07:00 · Libredtail Exploits CVE-2024-4577 for Cryptomining - SOC Prime
The Hacker News
Press · 19 Mar 2025, 07:00 · Hackers Exploit Severe PHP Flaw to Deploy Quasar RAT and XMRig Miners - The Hacker News
Bitdefender
Press · 17 Mar 2025, 07:00 · Technical Advisory: Mass Exploitation of CVE-2024-4577 - Bitdefender
BleepingComputer
Press · 11 Mar 2025, 07:00 · Critical PHP RCE vulnerability mass exploited in new attacks - BleepingComputer
See all 28 source documents
Cybersecurity Dive
Press · 10 Mar 2025, 07:00 · Critical PHP vulnerability under widespread cyberattack - Cybersecurity Dive
Security Affairs
Press · 10 Mar 2025, 07:00 · Experts warn of mass exploitation of critical PHP flaw CVE-2024-4577 - Security Affairs
GreyNoise
Press · 07 Mar 2025, 08:00 · GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign - GreyNoise
The Hacker News
Press · 07 Mar 2025, 08:00 · PHP-CGI RCE Flaw Exploited in Attacks on Japan's Tech, Telecom, and E-Commerce Sectors - The Hacker News
Cisco Talos Blog
Press · 06 Mar 2025, 08:00 · Unmasking the new persistent attacks on Japan - Cisco Talos Blog
Bitsight
Press · 07 Jan 2025, 08:00 · CVE-2024-4577: Windows Encoding Gone Wrong - Bitsight
BleepingComputer
Press · 20 Aug 2024, 07:00 · Hackers use PHP exploit to backdoor Windows systems with new malware - BleepingComputer
Cyber Press
Press · 11 Jul 2024, 07:00 · Hackers Exploiting PHP Vulnerability To Launch DDoS Attacks - Cyber Press
The Hacker News
Press · 11 Jul 2024, 07:00 · PHP Vulnerability Exploited to Spread Malware and Launch DDoS Attacks - The Hacker News
Akamai
Press · 10 Jul 2024, 07:00 · CVE-2024-4577 Exploits in the Wild One Day After Disclosure - Akamai
cyfirma
Press · 08 Jul 2024, 07:00 · PHP CGI Argument Injection (CVE-2024-4577)- Vulnerability Analysis and Exploitation - cyfirma
Help Net Security
Press · 13 Jun 2024, 07:00 · PHP command injection flaw exploited to deliver ransomware (CVE-2024-4577) - Help Net Security
GreyNoise
Press · 13 Jun 2024, 07:00 · What's Going on with CVE-2024-4577 (Critical RCE in PHP)? - GreyNoise
SecurityWeek
Press · 12 Jun 2024, 07:00 · Ransomware Group Exploits PHP Vulnerability Days After Disclosure - SecurityWeek
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 11 Jun 2024, 07:00 · PHP Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre
BleepingComputer
Press · 11 Jun 2024, 07:00 · TellYouThePass ransomware exploits recent PHP RCE flaw to breach servers - BleepingComputer
Field Effect
Press · 10 Jun 2024, 07:00 · Critical vulnerability discovered in PHP for Windows Servers - Field Effect
CCB Belgium
Press · 10 Jun 2024, 07:00 · Warning: PHP Remote Code Execution, Patch Immediately! - CCB Belgium
wiz.io
Press · 10 Jun 2024, 07:00 · Critical RCE vulnerability in PHP CGI: everything you need to know - wiz.io
SOCRadar
Press · 08 Jun 2024, 07:00 · Critical RCE Vulnerability (CVE-2024-4577) in PHP on Windows: Patch Now Available - SOCRadar
The Hacker News
Press · 08 Jun 2024, 07:00 · New PHP Vulnerability Exposes Windows Servers to Remote Code Execution - The Hacker News
watchTowr Labs
Press · 07 Jun 2024, 07:00 · No Way, PHP Strikes Again! (CVE-2024-4577) - watchTowr Labs
Bitdefender
Press · 06 Jun 2024, 07:00 · Technical Advisory: CVE-2024-4577 PHP Vulnerability Under Active Exploit - Bitdefender

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 1.6 · reality 9.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

18

Public exploit entries / repo candidates

See 18 repos with metrics
RepositoryStarsForksLanguageUpdated
watchtowrlabs/CVE-2024-457732563Python22 Jun 2024, 15:13
11whoami99/CVE-2024-4577439Shell09 Jun 2024, 16:16
ZephrFish/CVE-2024-4577-PHP-RCE3312Go30 Jul 2026, 13:40
BTtea/CVE-2024-4577-RCE-PoC254Python20 Nov 2024, 06:24
l0n3m4n/CVE-2024-4577-RCE71Python07 Jul 2024, 15:32
bibo318/CVE-2024-4577-RCE-ATTACK50Python11 Jul 2024, 08:37
CirqueiraDev/MassExploit-CVE-2024-457752Python03 Dec 2025, 14:42
Sh0ckFR/CVE-2024-457740Python13 Jun 2024, 15:17
zomasec/CVE-2024-457740Go09 Jun 2024, 16:47
d3ck4/Shodan-CVE-2024-457720Python12 Jun 2024, 07:02
VictorShem/CVE-2024-457721—31 Jul 2024, 04:13
sug4r-wr41th/CVE-2024-457710Python12 Apr 2025, 12:28
bl4cksku11/CVE-2024-457700Shell11 Jun 2024, 15:29
BLACK-ARCHIVERS/CVE-2024-457703—07 Jun 2024, 09:40
dbyMelina/CVE-2024-457700Python09 Jun 2024, 13:47
Dejavu666/CVE-2024-457700Python08 Jan 2025, 11:17
Ghost-Bx1/php-exploits-CVE-2026-109618-CVE-2026-109619-CVE-2024-457700Python01 Nov 2026, 04:27
Jcccccx/CVE-2024-457700Python31 Jul 2024, 10:37
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 100.0%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:18.907609+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
06 Jun 2024, 07:00
Published
09 Jun 2024, 19:42
Added to the CISA KEV catalog
12 Jun 2024, 00:00
Latest press mention
21 Oct 2026, 09:01
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
18 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar