Target Industry
The exploitation of this vulnerability is widespread, affecting organisations globally, with significant activity observed in Japan, the United States, Singapore, Germany, China, and other countries.
Overview
A critical(9.8) remote code execution (RCE) vulnerability, CVE-2024-4577, has been identified in the PHP-CGI implementation of PHP on Windows. This vulnerability allows unauthenticated attackers to execute arbitrary code remotely, leading to full system compromise. The issue stems from Unicode processing flaws in the CGI module of PHP when running on Windows.
Although patches were released in June 2024, the vulnerability has been actively exploited in the wild since January 2025. A proof-of-concept (PoC) was made publicly available shortly after the patch release, accelerating its adoption by threat actors.
Impact
Successful exploitation of CVE-2024-4577 enables attackers to:
- Gain unauthorised remote code execution on Windows servers running PHP in CGI mode
- Establish persistence and escalate privileges to SYSTEM level
- Deploy malware, web shells, and adversarial tools such as Cobalt Strike
- Steal credentials and conduct further post-exploitation activities.
Vulnerability Detection
Organisations should assess their environments for vulnerable versions of PHP installed on Windows systems. Affected versions include:
- PHP 8.3 – Update to 8.3.8 or later
- PHP 8.2 – Update to 8.2.20 or later
- PHP 8.1 – Update to 8.1.29 or later.
Exploitation
- Active exploitation: The vulnerability is actively exploited in the wild
- Proof-of-Concept (PoC) available: WatchTowr Labs released an exploit PoC a day after patches were released
- Observed attack activity: Cisco Talos and GreyNoise have reported increased exploitation attempts targeting various countries, with attackers deploying TaoWu Cobalt Strike plugins and attempting credential harvesting
Containment, Mitigations & Remediation
- Apply patches immediately: Update PHP installations to the latest secure versions (8.3.8, 8.2.20, or 8.1.29)
- Restrict PHP-CGI usage: If PHP is required, configure it to run in FastCGI or mod_php mode instead of CGI
- Monitor for Indicators of Compromise (IoCs): Regularly check logs for suspicious activity related to PHP-CGI execution
- Implement Web Application Firewalls (WAFs): Deploy rules to detect and block PHP-CGI exploit attempts
- Harden access controls: Limit public exposure of Windows-based PHP servers and enforce strong authentication measures
Indicators of Compromise
IPs Associated with Exploitation Attempts:
- 38[.]14[.]255[.]23
- 118[.]31[.]18[.]77
Observed Malicious Payloads:
- PowerShell script: http://38[.]14[.]255[.]23:8000/payload.ps1
Hash Identifiers:
- MD5 hash used in initial access: e10adc3949ba59abbe56e057f20f883e
Threat Landscape
GreyNoise has detected widespread global exploitation, with a significant increase in malicious activity observed in early 2025. More than 1,089 unique IPs have been seen attempting to exploit the vulnerability.
Key regions affected:
- Japan – Primary focus of initial attacks
- Singapore and Indonesia – Secondary surge in attack volume
- UK, Spain, India – Notable spikes in late January 2025
- Germany and China – Source of 43% of exploitation attempts in the past 30 days
Threat Group
While no specific advanced persistent threat (APT) group has been definitively linked, Cisco Talos has observed a targeted campaign against Japanese organisations since January 2025. Threat actors have used Cobalt Strike beacons and TaoWu toolkit plugins for post-exploitation activities.
Additionally, the TellYouThePass ransomware gang has been leveraging this vulnerability to deploy web shells and encrypt victim systems.
Tactics, Techniques, and Procedures
- T1190 – Exploit Public-Facing Application
- T1059.001 – Command and Scripting Interpreter: PowerShell
- T1543.003 – Create or Modify System Process: Windows Service
- T1068 – Exploitation for Privilege Escalation
- T1218.011 – Signed Binary Proxy Execution: Rundll32
- T1003.001 – OS Credential Dumping: LSASS Memory
- T1083 – File and Directory Discovery
- T1570 – Lateral Tool Transfer
- T1071.001 – Application Layer Protocol: Web Protocols
- T1041 – Exfiltration Over C2 Channel
