What happened in the PHP CVE - 2024 - 4577 ransomware breach and how to protect your servers

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• CVE - 2024 - 4577 is a critical remote - code - execution bug in PHP CGI on Windows, patched on June 6 2024.
• The TellYouThePass ransomware gang began exploiting the flaw within two days, using mshta.exe to run a malicious HTA that loads a .NET payload.
• Over 450 k PHP servers were identified as potentially vulnerable; roughly one - third were actually exploitable.
• Immediate mitigation steps: update PHP, disable CGI on Windows, restrict mshta.exe, and scan for web - shells.

Why did the CVE - 2024 - 4577 breach happen so quickly after the patch?

The breach happened because attackers had access to a public proof - of - concept exploit and began targeting unpatched Windows PHP CGI installations within 48 hours of the June 6 2024 release. Rapid exploitation is common for high - severity RCE bugs that affect widely deployed software.

How does the CVE - 2024 - 4577 exploit work?

The exploit abuses unsafe character - encoding conversions in PHP's CGI mode to inject arbitrary PHP code. The injected code launches the Windows mshta.exe binary, which runs a malicious HTA (HTML Application) file. That HTA contains VBScript that loads a .NET ransomware payload directly into memory, bypassing traditional file - based detection.

What was the impact of the ransomware campaign?

Victims saw a ransom note named READ_ME10.html and found their files encrypted. Ransom demands were around 0.1 BTC (approximately US$6,700). Censys reported more than 450 k exposed PHP servers that could be vulnerable, and Wiz estimated that about 34 % of those were actually exploitable, indicating a large attack surface.

Which systems are most at risk?

The vulnerability only affects PHP running in CGI mode on Windows. Any web server that hosts PHP - CGI without the June 6 2024 patch is at risk, especially those exposed to the internet without additional hardening such as firewall restrictions or WAF rules.

How can I verify if my server is vulnerable?

1. Check the PHP version: php -v. Versions 8.3.8, 8.2.20, and 8.1.29 include the patch.
2. Verify that CGI mode is disabled on Windows or that the patched binaries are in use.
3. Run a safe test request that triggers the known encoding conversion path (use a non - malicious payload) and confirm the server returns a 200 response without executing code.
4. Scan for known web - shell artifacts like READ_ME10.html or suspicious HTA files in web - root directories.

What immediate actions should I take?

• Update PHP to the patched releases (8.3.8, 8.2.20, or 8.1.29) on all Windows servers.
• Disable CGI mode if not required; prefer FastCGI or FPM on non - Windows platforms.
• Restrict mshta.exe execution via AppLocker or Windows Defender Application Control policies.
• Apply firewall rules to block inbound traffic to the PHP CGI endpoint from untrusted sources.
• Conduct a file - system scan for web - shells and the READ_ME10.html ransom note.
• Monitor logs for unusual POST requests containing encoded payloads.

How can I prevent similar future breaches?

• Enable automatic security updates for PHP and the underlying OS.
• Use a Web Application Firewall (WAF) that can detect and block known exploit patterns for PHP CGI.
• Regularly audit server configurations to ensure unnecessary modules (like CGI) are disabled.
• Subscribe to vulnerability feeds (e.g., NVD, PHP security announcements) and apply patches within the vendor’s recommended window.
• Perform periodic penetration testing or passive scans to identify misconfigurations before attackers do.

Where can I find more information?

• PHP Security Announcements page for CVE - 2024 - 4577 details.
• Censys and Wiz reports on exposed PHP servers.
• WatchTowr Labs blog post releasing the proof - of - concept exploit.
• NIST National Vulnerability Database entry for CVE - 2024 - 4577.

This article is based on publicly available vulnerability data and incident reports.