MB-8e5a69334b73f3fb0e415042d6d62fbbdc994e8d7f5d2f989072d6adffad85b5 high

Description

File type: sh. Size: 27042 bytes. Tags: sh. Reporter: abuse_ch. First seen: 2026-08-04 20:13:28.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• MalwareBazaar sample page Abuse.ch

  File type: sh. Size: 27042 bytes. Tags: sh. Reporter: abuse_ch. First seen: 2026-08-04 20:13:28.

• Mitigation Instructions for CVE-2024-4577 - CyRisk
  web:cyrisk.com

  CVE-2024-4577 is a severe argument injection vulnerability in PHP that can be exploited for Remote Code Execution (RCE). This flaw stems from errors in character encoding conversions, particularly the "Best-Fit" feature on Windows systems using Apache and PHP-CGI.

  2026-08-05 06:34 UTC
• Critical PHP RCE Vulnerability Under Mass Exploitation in New Attacks
  web:rewterz.com

  This vulnerability affects Windows systems running PHP in CGI mode and allows attackers to execute any code remotely, leading to full system control. Although it was patched in June 2024, attackers quickly began exploiting it, with proof-of-concept (PoC) code released a day after the patch.

  2026-08-05 06:34 UTC
• PDF 202406121500_PHP Programming Language Sector Alert_TLPCLEAR
  web:www.aha.org

  The vulnerability is actually a recurrence of an argument injection bug that was patched more than a decade ago. In 2012, while implementing PHP, an overlooked Best-Fit feature of encoding conversion within the Windows operating system allowed unauthenticated attackers to bypass the previous protecton of CVE-2012-1823 by specific character sequences.

  2026-08-05 06:34 UTC
• Critical PHP RCE vulnerability mass exploited in new attacks
  web:www.bleepingcomputer.com

  Threat intelligence company GreyNoise warns that a critical PHP remote code execution vulnerability that impacts Windows systems is now under mass exploitation.

  2026-08-05 06:34 UTC
• Supply-Chain Manipulation, PHP Deserialization Chains, and Automated ...
  web:www.brinztech.com

  Strategic Mitigation & Enterprise CMS Infrastructure Hardening Requirements To secure collaborative networks, eliminate third-party supply-chain backdoors, and protect corporate web environments from automated site takeovers, technology leads must prioritize the following out-of-band guidelines immediately:

  2026-08-05 06:34 UTC
• PHP Webshell Malware: Analysis, Detection, Removal | Huntress
  web:www.huntress.com

  PHP Webshell typically infects systems through vulnerabilities in web applications, weak credentials, or by exploiting unpatched software. Attackers often use phishing emails or compromised websites to deliver the malware.

  2026-08-05 06:34 UTC
• Critical PHP Vulnerability Under Mass Exploitation
  web:www.securityweek.com

  GreyNoise warns of mass exploitation of critical vulnerability (CVE-2024-4577) in PHP leading to remote code execution on vulnerable servers.

  2026-08-05 06:34 UTC
• CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog - Cool
  web:www.wiz.io

  Detect and mitigate CVE-2024-4577, a critical remote code execution vulnerability in PHP CGI. Organizations are advised to patch urgently.

  2026-08-05 06:34 UTC
• CVE-2025-49132 Impact, Exploitability, and Mitigation Steps | Wiz
  web:www.wiz.io

  Understand the critical aspects of CVE-2025-49132 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

  2026-08-05 06:34 UTC
• PHP Vulnerabilities | How to Find PHP Vulnerabilities | Zend
  web:www.zend.com

  Find an expert overview of common PHP vulnerabilities, including how vulnerabilities are scored, how they are disclosed to the community, and mitigation steps.

  2026-08-05 06:34 UTC

Only Available for Registered Users. Sign in to view.