Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A critical vulnerability (CVE-2024-4577) affects PHP-CGI on Windows when used with Apache and certain code pages. In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8, Windows may apply "Best-Fit" character replacement in command-line arguments, causing PHP-CGI to misinterpret these as PHP options. This can allow attackers to pass malicious options to the PHP binary, potentially exposing source code or enabling arbitrary code execution.

CVE-2024-4577 is an argument injection vulnerability in the PHP-CGI module on Windows platforms using Apache and specific code pages. Due to Windows' "Best-Fit" character replacement behavior in command-line arguments, PHP-CGI may incorrectly parse these characters as PHP options. This flaw exists in PHP versions prior to 8.1.29 for 8.1.*, prior to 8.2.20 for 8.2.*, and prior to 8.3.8 for 8.3.*, allowing attackers to pass crafted options to the PHP binary. Exploitation can lead to disclosure of PHP source code or execution of arbitrary PHP code on the server.

Detailed information about Argument Injection in PHP-CGI (CVE-2024-4577) affecting null php. Get real-time updates, technical details, and mitigation strategies

Argument Injection in PHP-CGI (CVE-2024-4577) - Live Threat Intelligence - Threat Radar | OffSeq.com

Argument Injection in PHP-CGI (CVE-2024-4577)

php-src

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

CVE-2024-4577 is an OS command injection vulnerability classified under CWE-78 that affects PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8. The flaw occurs specifically when PHP is run as a CGI module under Apache on Windows systems configured with certain code pages. Windows employs a 'Best-Fit' character replacement mechanism for command-line arguments passed to Win32 API functions, which can cause the PHP CGI module to misinterpret these replaced characters as command-line options for the PHP binary. This misinterpretation allows an unauthenticated attacker to inject arbitrary PHP options, potentially revealing the source code of PHP scripts or executing arbitrary PHP code on the server. The vulnerability does not require any privileges or user interaction and can be exploited remotely over the network. The CVSS v3.1 score of 9.8 reflects the critical nature of this vulnerability, highlighting its high impact on confidentiality, integrity, and availability. While no known exploits have been reported in the wild yet, the vulnerability poses a significant risk to web servers running vulnerable PHP versions on Windows. The issue arises from the interaction between Windows code page handling and PHP CGI's command-line parsing, making it a platform and configuration-specific problem. Remediation involves upgrading PHP to fixed versions 8.1.29, 8.2.20, or 8.3.8 or later, or applying vendor-provided patches once available.

Detailed information about CVE-2024-4577: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in PHP Group PHP aff

CVE-2024-4577: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in PHP Group PHP - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-4577: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in PHP Group PHP


Argument Injection in PHP-CGI (CVE-2024-4577)CVE-2024-4577 0 A critical vulnerability (CVE-2024-4577) affects PHP-CGI on Windows when used with Apache and certain code pages. In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8, Windows may apply "Best-Fit" character replacement in command-line arguments, causing PHP-CGI to misinterpret these as PHP options. This can allow attackers to pass malicious options to the PHP binary, potentially exposing source code or enabling arbitrary code execution. CriticalVulnerability#gcve #osv #bit-php-2024-4577 Join the discussion	GCVE Database	06/12/2024, 07:30:56 UTC Added: 09/08/2026, 12:55:58 UTC
CVE-2024-4577: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in PHP Group PHPCVE-2024-4577 0 In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+12#cve #cve-2024-4577 #cwe-78 Join the discussion	CVE Database V5	06/09/2024, 19:42:36 UTC Added: 10/21/2025, 19:06:29 UTC

Threats Tagged 'cve-2024-4577'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-4577'

Lead Pen Test Professional