CVE-2024-4577: the PHP flaw that hit Windows servers, explained

In June 2024, security researchers disclosed a critical flaw in PHP, tracked as CVE-2024-4577. It affected PHP running on Windows servers in a particular setup, and it let attackers run their own code on the server without logging in.

What was the problem?

When PHP runs in 'CGI mode' on Windows, Windows can quietly convert certain characters into others. Attackers found that this conversion let them sneak instructions past PHP's existing protections, re-opening an old flaw from 2012 that everyone thought was fixed.

It was most easily exploited on Windows systems set to certain Chinese and Japanese language settings, but researchers warned that other setups could be at risk too. Popular all-in-one packages like XAMPP were exposed in their default configuration.

How quickly was it exploited?

Very quickly. Within days of the announcement, attackers were scanning the internet for vulnerable servers. Ransomware groups were among those exploiting it. The US cybersecurity agency CISA added it to its list of known exploited vulnerabilities.

Was it fixed?

Yes. PHP released fixes in versions 8.1.29, 8.2.20 and 8.3.8. Servers on older, end-of-life PHP versions received no official fix at all. Their only option was to upgrade or change configuration.

Lessons for small businesses

• Attackers move in days, not months. Patching 'when we get round to it' isn't fast enough.
• End-of-life software doesn't get fixed. If you're on an old PHP version, the next big flaw may never be patched for you.
• Setup matters as much as version. The same PHP version can be safe on one server and vulnerable on another.
• Most owners don't know how their site is hosted. Finding out before the next flaw lands is much less stressful than finding out after.

Not sure whether a flaw in the news affects you? That's exactly what our assessments answer: a straight yes or no, and what to do about it.