Critical KEV + Ransomware

CVE-2024-4577

PHP on Windows CGI Remote Code Execution Vulnerability (CVE-2024-4577)

Vendor / product: PHP

Event date: 2024-06-10

Public PoC: Yes

First tracked by RiskWire: 2026-10-25

CISA KEV catalog

Added to KEV

2024-06-12 ↗

Federal remediation due

2024-07-03 (844 days overdue)

Ransomware campaign use

Known

CISA description

PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Sources & citations (1)

The Anatomy of CVE-2024-4577: Why You Shouldn't Abandon PHP Over a CGI Best-Fit Code Page Exploit dev.to · 2026-10-24

References

View on NVD ↗ View on MITRE CVE ↗ Search CISA ↗ KEV lookup tool

See CVE-2024-4577 in context

RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.

Book a 20-min demo →