Ransomware Operators Exploit Critical PHP Vulnerability for RCE

**Executive summary:** CVE-2024-4577 is a critical (CVSS 9.8) PHP vulnerability affecting Windows Apache/php-cgi configurations that is being actively and widely exploited in the wild; attackers can perform argument injection via Unicode 'Best-Fit' conversion to execute code, escalate to SYSTEM privileges, modify registry keys, install scheduled tasks and malicious services (including use of Cobalt Strike 'TaoWu'), and ransomware groups began exploiting the flaw within days of disclosure—patches are available in PHP 8.1.29, 8.2.20, and 8.3.8 and should be deployed immediately.