TellYouThePass ransomware exploits recent PHP RCE flaw to breach servers

TellYouThePass ransomware quickly weaponized the recently patched PHP RCE (CVE-2024-4577), using publicly available PoC to drop malicious HTA files that run VBScript to load a .NET encryptor in memory via mshta.exe; the malware contacts a C2 disguised as a CSS request, encrypts files, and leaves a READ_ME10.html ransom note demanding ~0.1 BTC. Researchers observed exploitation beginning June 8, and estimates show a large population of exposed PHP servers, increasing the campaign's potential impact.