---
title: "Security digest: June 6, 2024"
url: https://erroneo.us/security/2024-06-06/
description: "June 6, 2024 vulnerability digest: 1 brief (CVE-2024-4577: PHP-CGI Argument Injection RCE on…); 2 critical advisories (PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-06-06
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 6, 2024

1 editorial brief and 2 critical advisories.

## Take stock

- Act now: CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows . Operators of Windows servers running PHP through php-cgi.exe (Apache CGI mode, XAMPP's default /php-cgi/ alias, or php binaries in a web-reachable CGI directory), especially on Chinese or Japanese system locales.
- PyPI: 2 critical advisories ( lightning , mlflow ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows](https://erroneo.us/security/briefs/php-cgi-windows-argument-injection-cve-2024-4577/index.md): If you run PHP on Windows behind Apache in CGI mode (including any default XAMPP install), treat it as compromised-until-proven-otherwise and patch or remove CGI today; everyone else can relax.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2024-5452](https://erroneo.us/security/cve/CVE-2024-5452/index.md) Remote code execution in pytorch lightning — PyPI lightning < 2.3.3 → 2.3.3
- [CVE-2024-0520](https://erroneo.us/security/cve/CVE-2024-0520/index.md) Remote code execution in mlflow — PyPI mlflow < 2.9.0 → 2.9.0

---
Source page: https://erroneo.us/security/2024-06-06/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt