CVE-2024-4577·PHP vulnerability

How Defensia detected this

Defensia agents read the web server logs of the Linux servers they protect and match incoming requests against exploitation signatures. When the same CVE is matched across enough independent servers, from enough distinct networks, it is recorded as being actively exploited. That threshold was crossed for CVE-2024-4577 starting 2026-07-21, across 36% of the servers Defensia monitors, from 145 distinct attacking IP addresses.

Every CVE we currently measure under active exploitation is listed together, with the share of servers targeted and how long each has been running.

Aggregated across every server Defensia monitors, over 98 days of observation, last measured 2026-11-02. Counts are of distinct servers and distinct source addresses, not of requests. No customer, host or domain is identified.

Affected versions

How to fix this CVE

Upgrade PHP to 8.1.29+, 8.2.20+, or 8.3.8+ immediately. If upgrading is not possible, migrate from PHP-CGI to PHP-FPM. As a temporary workaround on Windows, apply Apache rewrite rules to block queries containing URL-encoded hyphens that trigger the Best-Fit mapping bypass.

sudo apt update && sudo apt install --only-upgrade php8.1 php8.2 php8.3
# Verify: php -v (should show 8.1.29+, 8.2.20+, or 8.3.8+)
# Switch to PHP-FPM:
sudo apt install php8.3-fpm
sudo a2enmod proxy_fcgi setenvif
sudo a2enconf php8.3-fpm
sudo systemctl restart apache2

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET /index.php?%ADd+allow_url_include%3Don+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1

Exploits Windows Best-Fit character mapping where soft hyphen (0xAD) converts to real hyphen (0x2D), injecting -d PHP CLI options through query string.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

SecRule QUERY_STRING "(?:%AD|%ad)" "id:20244577,phase:1,deny,status:403,msg:CVE-2024-4577 PHP-CGI argument injection attempt,severity:CRITICAL"

How to check if you are affected

1. Check PHP version: php -v — vulnerable if 8.1.x < 8.1.29, 8.2.x < 8.2.20, or 8.3.x < 8.3.8
2. Check SAPI type: php -r "echo php_sapi_name();" — vulnerable if cgi or cgi-fcgi on Windows
3. Scan Apache logs for exploit attempts: grep -iE "%ad|%AD" /var/log/apache2/access.log
4. Check if PHP-CGI handler is active: grep -r "Action.*php-cgi" /etc/apache2/
5. Verify no web shells dropped: find /var/www -name "*.php" -newer /var/log/syslog -mtime -1

Indicators of compromise

• Query strings containing %AD or %ad followed by PHP CLI flags (-d, -r, -n)
• POST requests to php-cgi with auto_prepend_file=php://input in query string
• Unexpected PHP processes with -d allow_url_include=on arguments
• Web shells in /tmp/.php_* or /var/www/html/.hidden.php

FAQ

Related PHP CVEs

References

• http://www.openwall.com/lists/oss-security/2024/06/07/1
• https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
• https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
• https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately
• https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/