PHP-CGI Argument Injection and Auto-Prepend RCE Attempts in Web Logs

Suraj A@cytech

•updated yesterday•1•0•12

Detects web requests attempting to exploit PHP-CGI command-line argument injection vulnerabilities (such as CVE-2012-1823 or the soft-hyphen variant CVE-2024-4577) or inject PHP configuration directives (e.g., allow_url_include, auto_prepend_file, php://input) via query strings or URIs to achieve pre-authentication remote code execution.