In June 2024, the PHP project disclosed CVE-2024-4577, a flaw in CGI argument parsing on Windows environments [1]. Attackers can use specific character sequences to bypass previous mitigations and achieve remote code execution [2]. Websites running PHP on Windows with CGI enabled (including certain XAMPP deployments) should update PHP immediately [2].
Backfill: this event became public on Jun 6, 2024 and we added it on Nov 8, 2026. It is not a new event.
PHP Discloses Windows CGI Argument Injection Vulnerability CVE-2024-4577
1 min read
- Disclosed
- Jun 6, 2024
- Published
- Nov 8, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- 100%, higher than 100% of CVEs
- Exploitation and patch status
- Patch available
- Attack vector
- Vulnerability status
- Actor type
- Motivation
- Language / package ecosystem
On this page
30-second summary
What happened
Who is affected
Organisations running: PHP Group PHP (Windows CGI)
What to do nowOur advice
Websites running Windows and PHP CGI (including certain XAMPP deployments) should update PHP immediately [2].
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| PHP Group PHP (Windows CGI) | 見 PHP 官方公告[1] | — | ✗ Unpatched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Source-Supported Details
Update to the official patched PHP release and check whether web servers still expose PHP in CGI mode [1].
Source excerpt: "There are numerous reports online with titles like \"Mitigating the iconv Vulnerability for PHP (CVE-2024-2961)\" or \"PHP Under Attack\". These titles are misleading as this is not a bug in PHP itself." [1].
References
Official / primary2
- [1]
“There are numerous reports online with titles like "Mitigating the iconv Vulnerability for PHP (CVE-2024-2961)" or "PHP Under Attack". These titles are misleading as this is not a bug in PHP itself.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.