What's Going on with CVE-2024-4577 (Critical RCE in PHP)? | Grey Noise Blog
Summary: GreyNoise Labs examined CVE-2024-4577, a remote code execution vulnerability in PHP affecting Windows deployments, discovered by DEVCORE and demonstrated by watchTowr. The flaw exploits a 'best-fit' Unicode processing behavior in Windows that lets attackers inject command-line arguments through HTTP requests, and the post includes payloads observed in the wild ranging from simple PHP snippets to scripts that download and execute malicious binaries.
What you should know: This is a remotely reachable RCE in PHP on Windows, and GreyNoise is already documenting payloads in the wild that download and run binaries - so the gap between disclosure and active exploitation is not theoretical.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2024-4577
- Related
- CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 12, 2024