PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

Summary: PHP rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a memory corruption and potential code execution flaw in the Brotli compression library bundled in those packages, reachable through the cURL extension when it automatically decompresses HTTP responses. The new builds (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) ship Brotli 1.2.1 and arrive five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws, with the same PHP source so those fixes remain.
Why it matters: Guzzle sets the empty CURLOPT_ENCODING value by default, so an application on last week's Windows builds keeping Guzzle's defaults meets the condition for reaching the flaw, which Google rates 9.2 Critical on CVSS 4.0. PHP's notice offers no workaround for systems that cannot be updated yet, and OpenAI warns that removing br from Accept-Encoding alone does not stop a server from sending Brotli.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-111497
Related: Siemens Industrial Edge Management Cyber Risks · Nov 12, 2026
Siemens Desigo, Gridscale Cyber Risks · Nov 12, 2026
Node2Shell (CVE-2026-111497) in active exploitation Cyber Risks · Oct 28, 2026