PHP Windows update fixes critical Brotli code execution flaw
The PHP Windows update for PHP 8.2 through 8.5 replaces a vulnerable copy of Brotli, a library that compresses data, in the project's official packages. PHP says CVE-2026-111497, a Common Vulnerabilities and Exposures identifier used to track a security flaw, can cause memory corruption and potentially let an attacker run code on an affected system.
PHP says the vulnerability is reachable through cURL, a software library that applications use to make web requests, when it automatically decompresses an HTTP response. HTTP is the protocol used to exchange web requests and responses. Automatic decompression asks a remote server for compressed content and then unpacks that content for the application. cURL does not enable this behavior by default, but PHP applications and HTTP client libraries can switch it on.
In PHP code, the CURLOPT_ENCODING option enables automatic decompression. Giving that option an empty value tells cURL to accept every compression format that it supports. An attack would require a crafted compressed response from a server contacted by the PHP application. This makes applications that retrieve content from external or otherwise untrusted servers an important part of the exposure scenario described by PHP.
Guzzle, a PHP library for sending HTTP requests, uses that empty CURLOPT_ENCODING value by default when it sends requests through cURL, according to code in releases 7.16.1 and 8.3.1. Based on that behavior and PHP's explanation, an application using Guzzle's default settings meets the condition for reaching the flaw when it runs on the affected Windows packages. The Hacker News said it had not tested that path on a Windows system.
The corrected packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They arrive five days after the October 21 releases that addressed two PHP2Shell remote code execution flaws. Remote code execution means an attacker can make a vulnerable system run instructions. The rebuilt packages retain the same PHP source and therefore keep those earlier fixes, while replacing the bundled compression library with Brotli 1.2.1.
Administrators need to pay attention to the package build rather than relying on the normal PHP version display. Running php -v shows the same version before and after the replacement because the PHP source version did not change. The new build is instead identified by the -1 in its filename, such as php-8.5.12-1-nts-Win32-vs17-x64.zip, and by the SHA-256 value on PHP's download page. SHA-256 is a digital fingerprint that can be compared with a downloaded file to check that the intended package was obtained.
PHP also publishes a software bill of materials, a list of the components bundled inside each package. The lists for the previous x64 Non Thread Safe builds of all four supported branches identify Brotli 1.2.0, which is affected. x64 refers to a 64-bit build, while Non Thread Safe is a PHP package type intended for environments that do not require PHP's thread-safety support.
Severity assessments differ because they use different versions of the Common Vulnerability Scoring System, or CVSS. Google assigned the flaw 9.2 out of 10 and classified it as Critical under CVSS 4.0. Red Hat scored it 8.1 and classified it as Important under CVSS 3.1.
There was no confirmed exploitation in the information cited. Imperva researchers achieved code execution through the same Brotli flaw on one official Node.js build, although their test required several attempts. PHP's notice does not report attacks. An October 23 assessment from the Cybersecurity and Infrastructure Security Agency, or CISA, recorded no exploitation, and the vulnerability was not in CISA's Known Exploited Vulnerabilities catalog as of that day's update.
OpenAI researchers found the flaw, and Google issued corrected Brotli versions 1.2.1, 1.1.1 and 1.0.10 when it was disclosed on October 21. Node.js, Bun and other software that bundles its own Brotli copy have also published fixes. For PHP's official Windows packages, PHP recommends installing the rebuilt downloads.
PHP's notice provides no workaround for systems that cannot yet be updated. OpenAI advises disabling automatic Brotli decompression in HTTP clients until the fixed software is installed. It also warns that merely removing br, the Brotli value used in the Accept-Encoding request header, does not prevent a server from sending a Brotli-compressed response.
For PHP applications using cURL directly, following that advice means not setting CURLOPT_ENCODING, because cURL does not otherwise decompress the response. With Guzzle, applications can set the decode_content request option to false. That disables all automatic response decoding, so gzip-compressed responses will also remain compressed and must be handled accordingly. Website owners who do not manage PHP themselves should ask their hosting or IT provider whether the affected Windows packages are installed and whether the rebuilt package has been applied. For organisations that need outside support while reviewing affected environments, AEU-I provides security-first IT, infrastructure and consulting.
The immediate priority is to replace the affected Windows build and verify the new package by filename and SHA-256 value. Checking only php -v is insufficient because the displayed PHP version remains unchanged after this security rebuild.