Key facts
Each fact is linked to the source that supports it.Summary
Remote code execution on Windows servers running Apache with PHP-CGI in certain code-page configurations. Character conversion can let request data be interpreted as PHP command-line options.
Component: PHP-CGI on Windows. Disclosed: 6 June 2024. Last verified: 22 October 2026, 16:45 UTC.
Affected versions
| Product | Affected range | Note |
|---|---|---|
| PHP 8.1 | < 8.1.29 | Windows PHP-CGI deployments in affected configurations. |
| PHP 8.2 | < 8.2.20 | Windows PHP-CGI deployments in affected configurations. |
| PHP 8.3 | < 8.3.8 | Windows PHP-CGI deployments in affected configurations. |
Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. NIST NVD PHP Group
Fixed versions
| Product | Fixed version | Note |
|---|---|---|
| PHP 8.1 | 8.1.29 | Security release, 6 June 2024. |
| PHP 8.2 | 8.2.20 | Security release, 6 June 2024. |
| PHP 8.3 | 8.3.8 | Security release, 6 June 2024. |
Fixed in 8.1.29, 8.2.20 and 8.3.8. Deployments not using PHP-CGI on Windows were not in the described scope. PHP Group
Conditions and scope
These are the conditions named by the sources. They are not a score and not a prediction.
- Microsoft Windows host.
- Apache HTTP Server using PHP-CGI.
- A system code page that triggers Windows Best-Fit character replacement.
- Not applicable to Linux PHP-FPM or mod_php deployments.
Exploitation status
CISA added CVE-2024-4577 to KEV on 12 June 2024. KEV indicates known exploitation; it does not publish incident counts.
Present in the downloaded CISA KEV catalog.
Catalog version · checked 22 October 2026, 16:53 UTC · added 2024-06-12.
Severity and scoring
Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.
Mechanism and scope
NVD describes a Windows-specific argument injection. When the system uses certain code pages, Windows may apply Best-Fit replacement to characters in a command line. PHP-CGI can then interpret request-derived characters as PHP options, allowing source disclosure or arbitrary PHP code execution depending on the request.
The condition is specific: Windows, Apache and PHP-CGI. A Linux PHP-FPM estate is not affected by this CVE, but that says nothing about the other entries in this library. Scope statements must be read per vulnerability.
Response lessons
The fix was available on the disclosure date. KEV listing four days later confirmed known exploitation. The useful operational lesson is inventory: PHP-CGI on Windows is easy to overlook because it may sit behind an older application or appliance rather than a modern container build.
Version strings alone are not enough. Verify the SAPI and the loaded binary, then confirm the vendor package contains the fix. This is the same verification problem that recurs with PHP2Shell.
What to do
- Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
- Interim controls and their limits — how to buy time without claiming a fix.
- Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.
Sources
Sources for this record
- Full text read
- Full text read
- Metadata only
Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.