A new critical security flaw has been discovered in PHP installations on Windows, enabling remote code execution (RCE) through a CGI argument injection vulnerability. Discovered by Devcore researcher Orange Tsai, this flaw, tracked as CVE-2024-4577, affects all PHP versions since 5.x and stems from an oversight in character encoding conversion, specifically the “Best-Fit” feature on Windows. This allows attackers to bypass protections for an older vulnerability, tracked as CVE-2012-1823, enabling arbitrary code execution on remote PHP servers. The vulnerability particularly affects XAMPP installations on Windows using Traditional Chinese, Simplified Chinese, or Japanese locales. Although patches for PHP versions 8.3.8, 8.2.20, and 8.1.29 have been released, widespread deployment complications could leave many systems vulnerable. Users are urged to upgrade to the patched versions or apply recommended mitigations if immediate upgrades aren’t feasible, with experts recommending a switch from outdated PHP CGI to more secure alternatives like Mod-PHP, FastCGI, or PHP-FPM. The Shadowserver Foundation and watchTowr Labs have already observed exploitation attempts, underscoring the urgency for users to apply the patches immediately due to the simplicity and high exploit potential of the bug. CTIX analysts recommend that administrators patch this flaw immediately to prevent exploitation.