Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · exploitation · confirmed
The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one day
Counted from the captured catalog.
Fact-check
A2 Reported●●○○○○ status overstated · Record · verdict: holds in part · the status word overstates the evidence
The KEV JSON (dateAdded 2024-06-12) and the CVE record (datePublished 2024-06-09T19:42Z) give three days (A6), and the php2shell KEV absence is A6 at 08:16Z on 22 Oct. 'Exploited in the wild one day after' rests on Akamai alone (A2), and it describes honeypot exploit attempts; 'the last PHP core RCE' is not shown (CVE-2024-4577 is a PHP-CGI argument injection on Windows).
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| cisa-kev-json | carries | nothing that carries it | ef8fffede5c47200 |
| cve-cve-2024-4577 | carries | nothing that carries it | e8cc1b1dcd1a3333 |
| akamai-blog-cve-2024-4577-one-day | carries | As early as one day after disclosure, the SIRT observed numerous exploit attempts to abuse this vulnerability | f7a58be0ecaaa8db |
| akamai-blog-cve-2024-4577-one-day | partial | we observed exploit attempts targeting this PHP flaw on our honeypot network within 24 hours of its disclosure. | f7a58be0ecaaa8db |
Open tickets: Evidence-1, Finding-20, Finding-21, Finding-76.
Graded in Run-1, resting on captures up to 2026-10-22 11:25 UTC. The scale is on the fact-check page.
This fact over time
- 2024Akamai Security Research publishes CVE-2024-4577 Exploits in the Wild One Day After Disclosure
- 2024-06-09 19:42 UTCCVE record publishes CVE-2024-4577 (PHP-CGI argument injection)
- 2026-10-21 14:04 UTCCISA publishes CISA Known Exploited Vulnerabilities catalog (JSON feed)
- 2026-10-22 11:25 UTCSaved into the evidence vault: Akamai Security Research
- 2026-10-22Enters this site as confirmed in v0.2.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · confirmed
The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one day Who says it: CISA KEV catalog; Akamai (2024) Status: confirmed Topic: exploitation Sources: cisa-kev-json, cve-cve-2024-4577, akamai-blog-cve-2024-4577-one-day