Hackers use PHP exploit to backdoor Windows systems with new malware

Symantec observed a newly discovered Windows backdoor, dubbed Msupedge, deployed at a university in Taiwan—likely via exploitation of the critical PHP-CGI RCE CVE-2024-4577. The attackers dropped two DLLs (weblog.dll loaded by Apache and wmiclnt.dll) and use DNS tunneling (based on dnscat2) for C2, enabling remote commands such as process creation and file download; the report notes active exploitation, public PoC release, and other actors rapidly abusing the same PHP flaw.