PHP Windows builds fix critical Brotli HTTP2Shell flaw
Original title: PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability
CVE-2026-111497, scored 9.2, is an out-of-bounds write that can crash a program, expose memory or run code.
PHP released Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 on October 26, 2026, bundling Brotli 1.2.1 to fix CVE-2026-111497, known as HTTP2Shell. On Windows the vulnerable decoder can be reached through the cURL extension when automatic HTTP decompression is enabled, a setting that is off by default. The same Brotli bug has also been found in Node.js, Python packages, .NET, FFmpeg, ClickHouse and Apache Arrow. Fixed upstream Brotli versions are 1.0.10, 1.1.1 and 1.2.1.
Unconfirmed: The report does not say whether CVE-2026-111497 is being exploited.
- The “-1” suffix marks a Windows dependency rebuild; PHP runtime versions do not change.
- Node.js disclosed the bug on October 21, when researchers called it Node2Shell.
- A separate October 21 PHP release fixed CVE-2026-109618 and CVE-2026-109619.
- PHP 8.2 reaches end of life on December 31, 2026.
- Microsoft and two Python package maintainers have also shipped patches.
Impact: Crash, memory exposure, or unauthenticated remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| PHP for Windows | — | 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1 |
| Google Brotli | — | 1.0.10, 1.1.1, 1.2.1 |
- 1.Install PHP Windows package 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1.
- 2.Confirm bundled Brotli is version 1.0.10, 1.1.1 or 1.2.1.
- 3.Keep untrusted Brotli input away from production systems if patching must wait.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at cybersecuritynews.com
The PHP team has released updated Windows builds to fix a serious flaw known as HTTP2Shell. The new packages are PHP 8. 5.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.