Skip to content
Critical RCE Vulnerability CVE-2024-4577 Affects PHP on Windows

Critical RCE Vulnerability CVE-2024-4577 Affects PHP on Windows

First seen 25 Oct 2026, 08:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 10:12 UTC
  • •CVE-2024-4577 is a critical RCE vulnerability in PHP affecting specific versions on Windows.
  • •Attackers can exploit this flaw to inject command-line options via CGI, compromising server security.
  • •Default XAMPP installations are particularly at risk due to exposure of the php-cgi.exe endpoint.

CVE-2024-4577 is a critical Remote Code Execution (RCE) vulnerability affecting PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8 when using CGI on Windows systems. The flaw arises from a 'best-fit' character mapping issue in Windows that allows attackers to inject command-line options into the PHP CGI binary. This vulnerability can lead to unauthorized execution of PHP code, potentially revealing sensitive information or executing arbitrary commands. The default XAMPP configuration is particularly vulnerable, as it exposes the php-cgi.exe endpoint. The vulnerability was publicly disclosed on June 9, 2024, and has been since June 12, 2024. Security professionals are urged to patch affected systems immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2012-05-11
CVE-2012-1823 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-06-09
CVE-2024-4577 published
A critical RCE vulnerability in PHP was disclosed, affecting specific versions on Windows.
Sploitus
2024-06-12
CVE-2024-4577 added to CISA KEV
CISA added CVE-2024-4577 to its Known Exploited Vulnerabilities catalog due to active exploitation.
Dev.To

More articles in this cluster (4)

Following this threat?

Track CVE-2012-1823 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4

Common questions

Which PHP versions are affected?
PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8 are affected.
Is CVE-2024-4577 actively exploited?
Yes, it has been confirmed that CVE-2024-4577 is actively exploited in the wild.
What should I do to protect my systems?
Update to the latest PHP versions immediately to mitigate the risk of exploitation.