# Source: CVE-2024-4577 (PHP-CGI argument injection)

CVE Program (cveawg API): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · cve · primary · captured

# CVE-2024-4577 (PHP-CGI argument injection)

**CVE Program (cveawg API)** · [https://cveawg.mitre.org/api/cve/CVE-2024-4577](https://cveawg.mitre.org/api/cve/CVE-2024-4577) · published 2024-06-09T19:42:36.464Z · added by `claude-story-site` · slug `cve-cve-2024-4577`

Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2024-06-09.

## What it says, as the collector read it

#### CVE-2024-4577 (PHP-CGI argument injection)

- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2024-06-09T19:42:36.464Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one dayCounted from the captured catalog. | CISA KEV catalog; Akamai (2024) | confirmed | 3/3 | [CISA](../../sources/cisa-kev-json/index.html) [CVE record](../../sources/cve-cve-2024-4577/index.html) [Akamai Security Research](../../sources/akamai-blog-cve-2024-4577-one-day/index.html) |

## Events that cite it

No timeline event cites this source yet.

## The bytes

No browser capture; see raw.
raw, 1 files with SHA256SUMS- `cveawg-api.json` e8cc1b1dcd1a3333776e9a0f08cd4543bc662e0ee60fc094bda0820f84b114eb

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.8 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/cve-cve-2024-4577/index.html