Wave radar · earlier wave · disclosed 2024-06-06

Was my website affected by PHP-CGI CVE-2024-4577?

Short answer: only if your site runs PHP on a Windows server. If it does, and the PHP version is older than 8.1.29, 8.2.20 or 8.3.8 (depending on its line), it is potentially affected. PHP on Linux and other systems is not affected. If we cannot see the PHP version or the server platform, we cannot tell. Paste your address below for a free check.

Email me the report link (optional)

We send one confirmation first. You can also choose to get an alert when a big vulnerability might affect you.

Just the address of your site. We check the home page and a few well-known public files.

This is an earlier wave. We added this page afterwards as background; it was not published when the flaw was disclosed. Last updated: 26 October 2026.

What happened

On 6 June 2024 the PHP project released PHP 8.3.8, 8.2.20 and 8.1.29 with a fix for CVE-2024-4577. The flaw was found by Orange Tsai of the security company DEVCORE. It affects PHP running in CGI mode on Windows. Because of how Windows converts some characters, someone who is not logged in could pass options to PHP and run their own code on the server.

DEVCORE confirmed the attack on Windows set to Traditional Chinese, Simplified Chinese or Japanese, and said it could not rule out other language settings. XAMPP for Windows, a popular package for running PHP sites, was vulnerable by default.

Attacks followed within days, including the TellYouThePass ransomware. On 12 June 2024 the US cybersecurity agency CISA added the flaw to its catalogue of vulnerabilities known to be exploited.

Which versions are fixed

PHP line Affected below Fixed in
8.3 8.3.8 8.3.8
8.2 8.2.20 8.2.20
8.1 8.1.29 8.1.29
8.0 and older no fixed release see below

PHP 8.0 and older were no longer supported in June 2024 and got no fix. DEVCORE says all PHP versions on Windows are affected, so a Windows server on those versions should move to a supported PHP line.

What our check can and cannot tell you

We look at your site from the outside, the way any visitor does. We read the PHP version your server reports, and whether the server says it runs Windows, and compare that with the table above. We do not test the flaw.

  • Potentially affected: your server reports Windows and a PHP version below the fix. We say potentially because we cannot see whether PHP runs in CGI mode or which language Windows is set to.
  • Cannot tell: your site runs PHP but hides the version, or it shows an old PHP version but does not say whether it runs on Windows. If you know your server is Linux, this flaw does not apply to you.
  • No sign of this problem: your site shows a fixed PHP version, or no PHP at all. This is "no sign from the outside", not a guarantee.

What to do

  1. Find out whether your site runs on Windows. Ask your host if you are not sure. If it does not, you are done.
  2. If it does, update PHP to 8.3.8, 8.2.20 or 8.1.29 or newer, or to a newer supported line.
  3. Consider leaving PHP-CGI behind. DEVCORE suggests PHP-FPM, FastCGI or mod_php instead. On XAMPP, the CGI alias can be switched off if you do not need it.
  4. If your Windows server ran an affected version in June 2024 or later, ask your developer or host to check for signs of a break-in.
  5. Run this check again after the update.

Official sources

Scanylo is not affiliated with the PHP project, DEVCORE, CISA or Imperva. This page is a plain-language summary, not a replacement for the advisories. This is a passive, external check and not a penetration test.

Why this page exists

This is an earlier wave, kept on the wave radar as background. We added the page afterwards; it was not published when the flaw was disclosed on 2024-06-06. Sites that never updated can still be exposed, so the check still runs.

Every time a major vulnerability wave hits the news, Scanylo publishes a check page within 24 hours. Tick the email alert box above and we will re-check your site on every new wave and tell you the result. It is free and needs no account. The check is passive: we read the version your site shows to any visitor and nothing else. Methodology.