CVE-2024-8926: 
PHP vulnerability analysis and mitigation

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 may still be bypassed. This vulnerability allows command injection related to Windows "Best Fit" codepage behavior (NVD).

The vulnerability is related to Windows codepage behavior and allows command injection attacks. It has been assigned a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) by NVD, while PHP Group assigned it a score of 8.1 HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (NVD).

The vulnerability allows malicious users to pass options to the PHP binary being executed, potentially revealing source code of scripts and enabling arbitrary PHP code execution on the server (SecurityOnline).

The vulnerability can be exploited remotely and requires low attack complexity according to the NVD assessment. It specifically affects systems using non-standard configurations of Windows codepages and bypasses previous fixes implemented for CVE-2024-4577 (NVD).

Users are advised to update to the patched versions: PHP 8.1.30, PHP 8.2.24, or PHP 8.3.12 to address this vulnerability (SecurityOnline).