DEVCORE published a detailed article a remote code execution vulnerability they discovered in PHP. This vulnerability, tracked as CVE-2024-4577, affects all versions of PHP installed on the Windows operating system. All versions of XAMPP installations on Windows are vulnerable by default.
