Alert! There’s a PHP vulnerability on Windows servers!
Patch immediately! A critical security vulnerability (CVE-2024-4577) was found regarding a PHP vulnerability on Windows servers using Apache and PHP.
Details:
- A critical PHP vulnerability (CVE-2024-4577)
PHP-CGI OS Command Injection Vulnerability. - Exists in versions 8.1.x before 8.1.29, 8.2.x before 8.2.20, and 8.3.x before 8.3.8 on Windows with Apache and PHP-CGI.
- Specific Windows code pages trigger “Best-Fit” character replacement in command lines.
- The PHP-CGI module misinterprets these characters as PHP options.
- Attackers can then exploit this to pass options to PHP binary being run, reveal the source code of scripts, run arbitrary PHP code on the server, etc.
- Update PHP: Ensure all PHP versions on Windows are updated to the latest versions (8.1.29, 8.2.20, 8.3.10.
- Security Monitoring: Monitor systems for web shell uploads and ransomware deployment attempts, particularly those utilizing the Tell You the Past ransomware.
- Advanced threat detection: Immediately identify suspicious activity and prevent attacks.
- Vulnerability detection: Scans and identifies known vulnerabilities in the operating system and applications installed on endpoints as soon as they are published.
- Real-time response: Quickly isolate and contain breaches before they spread.
- Expert guidance: Get the insights you need to reduce your attack surface and maintain a strong security posture.
- 24/7 SOC monitoring: Extend your security team with 24/7 expert monitoring. Our team safeguards your data and resources around the clock, giving you the peace of mind and expertise you need.
