PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
PHP has released updated Windows security packages for PHP 8.2 to 8.5 to address a Brotli compression library flaw (CVE-2026-111497). This vulnerability allows an attacker to corrupt memory and potentially execute malicious code. The flaw can be exploited via the cURL extension when it automatically decompresses HTTP responses. By default, cURL leaves decompression off, but applications and HTTP client libraries can enable it.
The new package versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 were released five days after the previous updates that fixed two PHP2Shell remote code execution flaws. The packages use the same PHP source and include Brotli 1.2.1, the corrected version. PHP provides a software bill of materials for each package, listing all components.
Despite the flaw, PHP reports no attacks as of its assessment on October 23. Users are advised to install the new builds from PHP's official website. To mitigate the issue, disable automatic Brotli decompression in HTTP clients or set appropriate options in cURL and Guzzle.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
