PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Original title: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
PHP rebuilt official Windows packages for PHP 8.2 through 8.5 to replace an included Brotli library affected by CVE-2026-111497, which can corrupt memory and potentially run code. PHP says the flaw is reachable through the cURL extension when automatic decompression of HTTP responses is enabled, which is off by default. Builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 keep the October 21 PHP source and add Brotli 1.2.1. Google rates the flaw 9.2 Critical and Red Hat 8.1 Important. CISA recorded no exploitation as of October 23.
Unconfirmed: The Hacker News did not test the Guzzle path on Windows, and PHP's notice does not mention attacks.
- Last week's x64 Non Thread Safe SBOMs listed Brotli 1.2.0.
- php -v is unchanged; the -1 filename and SHA-256 mark the new build.
- Guzzle 7.16.1 and 8.3.1 set an empty CURLOPT_ENCODING by default.
- OpenAI advises disabling automatic Brotli decompression; PHP lists no workaround.
- Google also fixed Brotli 1.1.1 and 1.0.10 when disclosing the flaw on October 21.
Impact: Memory corruption that can potentially run code
| Product | Affected | Fixed in |
|---|---|---|
| PHP Windows packages | 8.2 through 8.5 packages that include Brotli 1.2.0 | 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1 with Brotli 1.2.1 |
| Google Brotli | versions before 1.2.1, 1.1.1, and 1.0.10 | 1.2.1, 1.1.1, and 1.0.10 |
- 1.Install the rebuilt Windows packages from PHP's downloads page.
- 2.Turn off automatic Brotli decompression in HTTP clients until updated.
- 3.In Guzzle, set decode_content to false to stop automatic decoding.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at thehackernews.com
PHP has rebuilt its official Windows packages for PHP 8. 2 through 8. 5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.