PHP RCE Attack

FortiGuard Labs reports that CVE-2024-4577, a Windows PHP CGI argument-injection vulnerability leading to remote code execution, is being actively exploited in the wild; TellYouThePass ransomware and other threat actors have used it to deploy web shells, backdoors (e.g., Msupedge), and various malware families. Telemetry and third-party reporting indicate widespread exposure and significant attack activity (PoC published, multiple malware campaigns, and tens of thousands of IPS detections); vendors have released patches and IPS signatures to mitigate the risk.