Grey Noise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577)
Summary: GreyNoise's Global Observation Grid honeypot network detected 1,089 unique IPs attempting to exploit CVE-2024-4577, a critical PHP-CGI remote code execution flaw with 79 exploits available, during January 2025. Cisco Talos reported the flaw was used against Japanese organizations to deploy Cobalt Strike beacons and run post-exploitation activity with the TaoWu toolkit, while GreyNoise observed spikes in the United States, Singapore, Japan and other countries, with more than 43% of IPs targeting the flaw in the past 30 days coming from Germany and China.
What's compelling: More than 43% of recent attacking IPs trace to just Germany and China, and a February coordinated spike suggests automated scanning is still widening - so any internet-facing Windows system exposing PHP-CGI is already in the scan path, not a hypothetical target.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-4577
- Related
- CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 12, 2024