Patch it up: Old vulnerabilities are everyone’s problems
Summary: Cisco Talos reported that an unknown attacker, active since as early as January 2025 and predominantly targeting organizations in Japan, exploited CVE-2024-4577, a remote code execution flaw in the PHP-CGI implementation of PHP on Windows, to gain initial access. The attacker established persistence by modifying registry keys, adding scheduled tasks, and creating malicious services using plugins from the Cobalt Strike kit called "TaoWu."
What's compelling: The newsletter notes that CVE-2025-22224 was added to CISA's KEV catalog less than two hours after publication, yet over 40,000 vulnerable instances were still detected globally a week later - and KEVs added in 2024 included CVEs dating back to 2012, 2013, and 2014.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2024-4577CVE-2025-22224
- Related
- CVE-2025-22224: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability Known Exploited Vulnerabilities · Mar 04, 2025CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 12, 2024