PHP Vulnerability Used For Malware And DDOS Attacks

The report details the rapid in-the-wild exploitation of PHP vulnerability CVE-2024-4577 (CVSS 9.8), which allows attackers to escape the command line via Unicode conversion flaws. Exploits were observed within 24 hours of disclosure and have been used to deliver multiple malicious payloads—crypto miners (RedTail, XMRig), the Muhstik DDoS botnet, Gh0st RAT, and a .NET ransomware variant linked to Tell You The Pass—underscoring urgent patching and mitigation needs.