Summary
A critical argument injection vulnerability in Windows-based PHP installations running in CGI mode continues to draw mass exploitation activity two years after its disclosure, with attackers deploying cryptocurrency miners, remote access tools, and botnet infrastructure at scale against unpatched systems. The sustained campaign signals that a large population of vulnerable installations remains reachable and is being actively consumed by multiple competing operators.
What Happened
CVE-2024-4577 affects PHP when running in CGI mode on Windows. The flaw allows an unauthenticated attacker to inject arguments into the PHP interpreter by exploiting how Windows converts certain Unicode characters during path processing—causing crafted inputs to be treated as executable instructions rather than data. No authentication is required to trigger code execution on a vulnerable system.
The vulnerability was disclosed in June 2024. Rather than declining over time, exploitation has expanded into a persistent background campaign with no clear sign of deceleration. Researchers have documented multiple distinct operator strands running simultaneously, competing for access to the same vulnerable host pool. Approximately 15 percent of recorded attempts are basic reconnaissance using built-in Windows commands; another 15 percent use native Windows administration tools for deeper enumeration; roughly 5 percent proceed directly to cryptomining payload deployment.
Common payloads include XMRig mining software configured to mine Monero, delivered alongside a vulnerable kernel driver that conceals mining activity from standard monitoring tools. A second payload strand deploys Quasar RAT, a capable remote access tool enabling keylogging, screen capture, file transfer, and persistent command execution. Attackers have also been observed modifying firewall rules on compromised hosts to defend mining infrastructure against competing operators—a sign that some compromised systems are being treated as persistent assets rather than one-time targets.
Patches are available in PHP 8.3.8, 8.2.20, and 8.1.29. Systems running PHP 8.0, 7, or 5—branches no longer receiving security updates—have no vendor patch available and should be treated as permanently exposed until migrated. PHP installations in CGI mode on Windows should be audited and patched as a priority; the attack tooling is widely distributed and the vulnerability remains highly accessible to low-sophistication operators.
Domain Intelligence
php.net — 62.81
php.net scores 62.81 in the WarmBadge graph. The score reflects the domain’s position within a heavily targeted infrastructure ecosystem. CVE-2024-4577 has become a persistent mass campaign; the signal around php.net captures not any organizational failing but the sustained exploitation activity that follows a high-severity flaw affecting one of the internet’s most widely deployed server-side runtimes.