Bug affecting PHP scripts demands ‘immediate action from defenders globally’

Researchers report mass exploitation of CVE-2024-4577, a critical PHP-CGI remote code execution vulnerability: initially observed targeting Japanese organizations, activity has expanded globally (notable spikes in the U.S., Singapore, and Japan). Cisco Talos observed attackers deploying a C2 infrastructure and tools to steal credentials and maintain persistence, GreyNoise documented widespread scanning/exploitation patterns, and Symantec reported earlier exploitation against a Taiwanese university; a patch exists but exploitation continues, prompting urgent defensive action.