PerfoMetrix

All vulnerabilities · PHP

PHP-CGI Argument Injection (CVE-2024-4577): Check Your Site and Patch

CVE-2024-4577CVSS 9.8Actively exploited (CISA KEV)

CVE-2024-4577 lets attackers run code on Windows servers that run PHP in CGI mode. Check which PHP version your site shows, which releases are fixed, and how to patch.

Is your site affected? Check the PHP version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
>=8.1.0 <8.1.29
>=8.2.0 <8.2.20
>=8.3.0 <8.3.8
8.1.29
8.2.20
8.3.8

CVE-2024-4577 is a critical flaw in PHP running as CGI on Windows. Some Windows code pages silently convert certain characters (a “Best-Fit” mapping), which lets a request smuggle command-line options into php-cgi. An attacker can use that to run their own code on the server without logging in. CISA added it to its catalog of actively exploited vulnerabilities within days of disclosure, and ransomware groups have used it since.

Who is affected

  • PHP 8.1 before 8.1.29, 8.2 before 8.2.20 and 8.3 before 8.3.8.
  • Only on Windows, and only where PHP runs in CGI mode (php-cgi.exe) or where php-cgi is reachable, which is the default in some XAMPP installations.
  • PHP 8.0 and older are end of life and received no fix at all; treat them as affected.

Linux servers and Windows servers using PHP-FPM or the IIS FastCGI module in its usual setup are not exposed to this specific bug, but should still be updated.

What our check looks at

We read the PHP version your server announces in its X-Powered-By header and compare it with the affected ranges above. We send no exploit and no special request. If the header is hidden, we can’t tell, which is a good thing in itself.

How to fix it

  1. Update PHP to 8.1.29, 8.2.20, 8.3.8 or later (current releases are better still).
  2. Stop running PHP as CGI on Windows. Use PHP-FPM behind a web server, or the FastCGI module of IIS.
  3. On XAMPP, update to a release that ships a fixed PHP, or remove the ScriptAlias that exposes php-cgi.exe in httpd-xampp.conf.
  4. Hide the version: set expose_php = Off in php.ini and restart the web server.

FAQ

How do I know if my site is affected?

Check the PHP version on the server (php -v) and whether PHP runs as CGI on Windows. Our scan shows the version your site exposes publicly, but only the server itself can confirm how PHP is run.

Is a site behind a firewall or CDN safe?

A web application firewall may block known attack patterns, but it doesn’t remove the flaw. Update PHP regardless.

Our version is hidden. Are we safe?

Not necessarily. Hiding the version only stops strangers from reading it. Confirm the version on the server.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free