Attackers intensify exploitation of PHP CGI bug CVE-2024-4577 to deliver ransomware and cryptominers

Criminal operators are actively exploiting CVE-2024-4577, a PHP CGI argument injection flaw, to gain remote code execution on internet facing servers today. The activity concentrates on Apache for Windows configured to run PHP in CGI mode, where crafted query strings trigger php-cgi.exe to execute attacker supplied directives without authentication.

This matters now because public proof of concept code has been available since June 2024 and exploitation is fully automated. Many legacy Windows stacks still run PHP-CGI, web application firewalls can miss non ASCII encodings that abuse Windows code pages, and intrusions quickly pivot to data theft or ransomware.

Exploitation path and payloads

The exploit abuses how PHP on Windows interprets certain multi byte characters under legacy code pages such as CP936. Attackers send requests to .php endpoints with query parameters that resolve into PHP command line flags, for example -d allow_url_include=On and -d auto_prepend_file=php://input, then post a web shell or one liner payload. On compromise, httpd.exe or php-cgi.exe spawns cmd.exe or powershell.exe to retrieve second stage code.

Observed payloads include TellYouThePass ransomware, XMRig cryptominers, and loader scripts that establish persistence through scheduled tasks and registry Run keys. Some crews deploy lightweight reverse shells, then enumerate domain trusts and attempt lateral movement using harvested credentials. Indicators include requests containing -d or -s flags directed at PHP endpoints, high CPU from php-cgi.exe, and new outbound connections from web servers to unfamiliar VPS hosts.

Mitigation and detection

Administrators should eliminate PHP-CGI where possible. Migrate to supported SAPIs such as PHP-FPM or the Apache module, and update PHP to fixed releases 8.3.8, 8.2.20, or 8.1.29. Apply vendor guidance to disable or block direct access to php-cgi.exe, and restrict public access to administrative and upload endpoints behind authenticated proxies.

Short term hardening includes web server rules that reject requests to .php with arguments beginning with a hyphen, input validation that blocks suspicious encodings, and geo IP or reputation based filtering to rate limit scanning. These measures reduce exposure but do not replace patching and architectural changes.

Detection should focus on process behavior and logs. Alert on php-cgi.exe or httpd.exe spawning cmd.exe, powershell.exe, schtasks.exe, curl.exe, or certutil.exe on Windows. Hunt for IIS or Apache logs that show .php requests with -d, -s, -H, or auto_prepend_file in the query string, especially when paired with non ASCII bytes. Monitor for new scheduled tasks, unexpected PHP configuration changes, and anomalous outbound connections from web tier hosts.

The campaign underscores the risk of long tail web stacks built on legacy Windows code pages and CGI. Teams that modernize runtimes, remove CGI, and standardize on supported deployment models reduce entire classes of argument parsing bugs before they become the next mass exploitation event.