Critical RCE vulnerability in PHP CGI: everything you need to know

Researchers disclosed CVE-2024-4577, a critical PHP CGI remote code execution vulnerability affecting Windows PHP builds (notably PHP 8.3 < 8.3.8, 8.2 < 8.2.20, 8.1 < 8.1.29). Public exploit code and exploitation attempts were observed shortly after patches were released, and the TellYouThePass ransomware gang has been actively exploiting the flaw to deploy webshells and a .NET encryptor via mshta/HTA chains, encrypting victim files and demanding ransom; immediate patching or mitigations are advised.