Vulnerability threat dossier
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
VTP analyst assessment
CISA KEV lists CVE-2024-4577 as exploited globally, including known ransomware campaign use. On Windows Apache deployments using PHP-CGI and certain code pages, crafted characters can be interpreted as PHP options. This can let a remote attacker pass options to the PHP binary. Greenbone reports public exploit tooling coverage, but its tooling evidence does not establish successful execution.
1 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
The supplied exploit-tooling report does not establish exploit reliability or successful use against a particular deployment.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
If you use PHP-CGI with Apache on Windows, identify affected versions and code-page configurations, then update to PHP 8.1.29, 8.2.20, 8.3.8, or a later supported release.
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2024-4577. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
A proof of concept is reported; functional reliability is not established.
EPSS is 1.00; this is predictive context, not exploitation evidence.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 1 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
Greenbone Community Feed published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
Greenbone Community Feed recorded exploit-tooling coverage changes for 6 CVEs in this pinned revision. 6 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.
Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including
Technical vulnerability data
Raw observations
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.