---
title: "CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows"
url: https://erroneo.us/security/briefs/php-cgi-windows-argument-injection-cve-2024-4577/
description: "Windows PHP-CGI (incl. default XAMPP) allows unauthenticated RCE; fixed in 8.3.8/8.2.20/8.1.29. In KEV, used by ransomware. Patch or drop CGI now."
type: security-brief
section: "Security Digest"
date_published: 2024-06-06
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2024-4577"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows

**Verdict: Act now.** If you run PHP on Windows behind Apache in CGI mode (including any default XAMPP install), treat it as compromised-until-proven-otherwise and patch or remove CGI today; everyone else can relax.

- **Who must act:** Operators of Windows servers running PHP through php-cgi.exe (Apache CGI mode, XAMPP's default /php-cgi/ alias, or php binaries in a web-reachable CGI directory), especially on Chinese or Japanese system locales.
- **Who can relax:** Linux and macOS PHP hosts, and Windows hosts using mod_php, FastCGI or PHP-FPM rather than PHP-CGI, are not affected by this bug.
- **Affected:** PHP 8.1.x before 8.1.29 on Windows (CGI mode); PHP 8.2.x before 8.2.20 on Windows (CGI mode); PHP 8.3.x before 8.3.8 on Windows (CGI mode); End-of-life PHP 8.0, 7.x and 5.x on Windows (no fix); XAMPP for Windows default configuration
- **Fixed:** PHP 8.3.8; PHP 8.2.20; PHP 8.1.29 (8.1 is now end-of-life; move to a supported branch)
- **CVEs:** CVE-2024-4577
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory Windows hosts running PHP and check `php -v` and whether php-cgi.exe is reachable over HTTP
2. Upgrade to a supported PHP branch (8.2 or later) at or above the fixed releases
3. On XAMPP, comment out the `ScriptAlias /php-cgi/` line in httpd-xampp.conf if you do not need PHP-CGI
4. Migrate off PHP-CGI to mod_php, FastCGI or PHP-FPM
5. If you cannot patch immediately, add DEVCORE's mod_rewrite rule blocking query strings that begin with %ad

### How to check if you are affected

- Search Apache access logs for requests to php-cgi paths with query strings starting with %AD or containing -d allow_url_include or auto_prepend_file
- Look for mshta.exe or unexpected child processes spawned by httpd.exe or php-cgi.exe
- Check for unfamiliar PHP files in the web root and ransom notes or encrypted files (TellYouThePass)

## What happened

On June 6, 2024 PHP shipped 8.3.8, 8.2.20 and 8.1.29 to fix an argument injection flaw in PHP-CGI on Windows, and [DEVCORE, which reported it on May 7](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/), published its alert the same day. The bug bypasses the protection added for CVE-2012-1823. Windows "Best-Fit" character conversion can turn certain characters in the command line into a hyphen, so PHP-CGI ends up reading attacker-controlled query string data as command-line options. [NVD's description](https://nvd.nist.gov/vuln/detail/CVE-2024-4577) says this can reveal source code or run arbitrary PHP code. NVD and the PHP CNA both score it CVSS 3.1 9.8.

Exploitation followed within days. [Imperva observed attacks from June 8](https://www.imperva.com/blog/update-cve-2024-4577-quickly-weaponized-to-distribute-tellyouthepass-ransomware/) that delivered TellYouThePass ransomware: the injected PHP launched an HTA payload through `mshta.exe`, which loaded a .NET encryptor in memory. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on June 12, 2024 with a July 3 federal due date. As of October 21, 2026 the KEV entry marks known ransomware campaign use as "Known."

## Who is affected

Per the [PHP advisory](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv), affected versions are 8.1 before 8.1.29, 8.2 before 8.2.20 and 8.3 before 8.3.8, and only on Windows. End-of-life branches (8.0, 7, 5) received no fix. DEVCORE confirmed direct exploitation on systems using the Traditional Chinese (950), Simplified Chinese (936) and Japanese (932) code pages. For other locales, including English, it could not rule out every scenario, so do not treat an English locale as a safe harbor. Exposure requires PHP running as CGI: Apache with `php-cgi.exe`, or the PHP binary in a web-reachable CGI directory. DEVCORE noted that XAMPP for Windows maps `/php-cgi/` by default, which made every default Windows XAMPP install vulnerable.

## Do you really need to act?

For a narrow group, yes, immediately. The bug is unauthenticated, remotely triggerable with a single HTTP request, publicly documented and in active use by ransomware crews. If that describes your server and it was unpatched for any length of time since June 2024, assume someone has tried it.

For most PHP shops, no. Linux hosts, PHP-FPM, FastCGI and mod_php setups are not exposed. Note too that 8.1 is no longer listed on [PHP's supported versions page](https://www.php.net/supported-versions.php). "Patched to 8.1.29" stops the bug but leaves you on an unsupported branch.

## What to do now

1. Find Windows PHP hosts: run `php -v` and check your Apache config for `ScriptAlias` or `Action` directives pointing at `php-cgi.exe`.
2. Upgrade to a supported branch (8.2 or later) at or above the fixed releases.
3. On XAMPP, comment out `ScriptAlias /php-cgi/` in `httpd-xampp.conf` unless you truly need it.
4. Move off CGI to mod_php, FastCGI or PHP-FPM. DEVCORE calls PHP-CGI outdated and problematic.
5. As a stopgap, apply DEVCORE's mod_rewrite rule rejecting query strings that begin with `%ad`.

## How to tell if you were hit

Grep Apache access logs for requests to `php-cgi` paths whose query string starts with `%AD` or carries options such as `allow_url_include` or `auto_prepend_file`. On the host, look for `mshta.exe` or shells spawned by `httpd.exe` or `php-cgi.exe`, new PHP files in the web root, and TellYouThePass ransom notes. If you find any of these, rebuild the host rather than clean it.

## Timeline

- May 7, 2024 — DEVCORE reports the issue to PHP, which confirms it the same day.
- Jun 6, 2024 — PHP 8.3.8, 8.2.20 and 8.1.29 released. DEVCORE publishes its alert.
- Jun 8, 2024 — Imperva sees TellYouThePass ransomware exploiting the bug.
- Jun 9, 2024 — CVE published in NVD.
- Jun 12, 2024 — CISA adds CVE-2024-4577 to KEV.

## Sources

1. [NVD — CVE-2024-4577](https://nvd.nist.gov/vuln/detail/CVE-2024-4577)
2. [PHP (GitHub) — GHSA-3qgc-jrrr-25jv: Argument Injection in PHP-CGI](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv)
3. [DEVCORE — Security Alert: CVE-2024-4577 PHP CGI Argument Injection Vulnerability](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/)
4. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
5. [Imperva — CVE-2024-4577 Quickly Weaponized to Distribute TellYouThePass Ransomware](https://www.imperva.com/blog/update-cve-2024-4577-quickly-weaponized-to-distribute-tellyouthepass-ransomware/)
6. [PHP — Supported Versions](https://www.php.net/supported-versions.php)

---
Source page: https://erroneo.us/security/briefs/php-cgi-windows-argument-injection-cve-2024-4577/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt