Cyber Intruders Leverage PHP Vulnerability, Unleash Quasar RAT and XMRig Miners

Cyber Intruders Leverage PHP Vulnerability, Unleash Quasar RAT and XMRig Miners

At a glance

• Recent Exploit: Attackers are mass-exploiting CVE-2024-4577, a critical argument-injection flaw in PHP-CGI on Windows.
• Malware Deployment: The flaw is being used to drop the Quasar RAT and XMRig cryptocurrency miners.
• Impact Assessment: Unpatched Windows web servers running PHP in CGI mode face remote takeover, data theft and hijacked CPU time.
• Security Recommendations: Patch PHP, or move off CGI mode, and check servers for the payloads described below.

How attackers are getting in through PHP-CGI

The bug is CVE-2024-4577. It lets an attacker run code on Windows servers that use PHP in CGI mode, and it affects the 8.1, 8.2 and 8.3 branches before the June 2024 fixes, plus older unsupported releases such as 8.0. Fixes have existed for months. Even so, Bitdefender reported in March 2025 that exploitation had surged, with attackers using the flaw to break into web servers and install malware.

The attack starts with a crafted web request that smuggles command-line arguments into PHP. That gives the attacker code execution. From there, batch scripts use PowerShell or certutil to pull down the next stage from attacker-controlled servers.

Quasar RAT, an old tool in a new campaign

One of those payloads is Quasar RAT, a well-known open-source remote access trojan. Criminals like it because it gives them full control of an infected machine: they can log keystrokes, take screenshots and copy files off the server while staying fairly quiet.

Pairing an old, dependable tool like Quasar with a freshly mass-exploited bug is a common pattern. Attackers don’t need new malware when the door is wide open, and defenders who only hunt for novel payloads will miss it.

XMRig and the cost of a hijacked server

Other attackers use the same flaw to install XMRig, a miner for the Monero cryptocurrency. The miner burns the victim’s processing power to earn money for the attacker. Servers slow down, cloud bills go up, and the miner can hide a more serious intrusion underneath. Bitdefender also saw miners disguised under harmless-looking file names.

The two payloads point to different goals. Quasar gives an attacker control and a foothold for later. XMRig turns that access into money right away.

Patch PHP-CGI now

The fix is clear. Update PHP to 8.3.8, 8.2.20 or 8.1.29 or later, and move off PHP-CGI on Windows where you can, since older unsupported branches will not get patches. Intrusion detection and prevention tools help catch exploit attempts against servers that cannot be updated right away.

Then look for signs of compromise. Harden server configurations, audit systems for unexpected scheduled tasks and outbound connections, and check for unfamiliar processes using heavy CPU.

What defenders should take from it

CVE-2024-4577 was patched in June 2024, yet attackers were still finding plenty of unpatched servers months later. Patch speed matters more than almost anything else here.

Long-lived flaws like this one reward attackers who scan widely and wait. Teams that keep an inventory of internet-facing servers, patch on a schedule and watch for odd outbound traffic will close that window much faster.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.