PHP CGI argument injection
Deployment context decides whether a library or runtime bug is reachable. This advisory is valuable as a reminder to connect version inventory with web-server mode, interpreter interface, and public routing. The curation preserves that verification mindset…
- Original severity
- critical; CVSS 9.8 source-reported; not rescored by vulns.co
- Public source
- github advisory
- Program / vendor
- PHP
- Product / surface
- PHP CGI deployments behind Apache
- Weakness
- OS command injection · CWE-78
- Affected boundary
- web-server request parsing to interpreter argument boundary
- Disclosure date
- 2024-06-09
- Public status checked
- 2026-09-10
What the evidence established
The source describes a deployment-specific argument-handling issue involving PHP CGI and Apache configurations.
Why the impact was credible
The source rates the issue Critical with CVSS 9.8; exposure depends on the affected deployment arrangement.
Durable engineering lesson
Deployment context decides whether a library or runtime bug is reachable. This advisory is valuable as a reminder to connect version inventory with web-server mode, interpreter interface, and public routing. The curation preserves that verification mindset while excluding the request construction details that do not belong in a general learning archive.
Control pattern
Upgrade PHP, identify CGI-mode deployments rather than relying on package inventory alone, and remove obsolete interpreter exposure patterns where possible.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.