PHP has issued an important update for its Windows packages, addressing a critical security flaw in the Brotli compression library. This vulnerability, identified as CVE-2026-111497, affects PHP versions 8.2 through 8.5 and poses a risk of memory corruption and potential code execution by attackers.
According to PHP, this flaw can be triggered through the cURL extension when it automatically decompresses HTTP responses. Although automatic decompression is not enabled by default in cURL, it can be activated by various applications and HTTP client libraries.
Details of the Security Update
The newly rebuilt PHP packages—versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1—were released just five days following an earlier update on October 21 that addressed the PHP2Shell remote code execution vulnerabilities. The updated packages incorporate Brotli version 1.2.1, which resolves the identified flaw while maintaining fixes from the previous release.
PHP provides a software bill of materials with each package, detailing its components. The previous x64 Non Thread Safe builds included Brotli 1.2.0, one of the vulnerable versions. PHP advises users to download the updated builds from its official website.
Impact on Developers and Applications
In PHP, enabling automatic decompression involves using the CURLOPT_ENCODING option, where an empty value allows all supported formats. The Guzzle HTTP client library sets this option to an empty value by default, potentially exposing applications to the vulnerability when using last week’s Windows builds. The flaw could be exploited through a crafted server response targeting the PHP application.
Google has rated the flaw as ‘Critical,’ with a score of 9.2 on the CVSS 4.0 scale, while Red Hat has deemed it ‘Important,’ scoring it 8.1 on the CVSS 3.1 scale. Despite the severity, there are no confirmed reports of exploitation, according to CISA’s October 23 assessment.
Recommendations and Future Outlook
OpenAI researchers discovered the flaw, and Google addressed it in Brotli updates 1.2.1, 1.1.1, and 1.0.10. While PHP’s notice does not offer a workaround for systems unable to update immediately, OpenAI advises disabling automatic Brotli decompression until the update is applied. This can be done by not setting CURLOPT_ENCODING in PHP code, or by adjusting Guzzle’s decode_content request option to false.
As PHP continues to enhance its security measures, developers are urged to stay vigilant and ensure their systems are promptly updated. Keeping abreast of such updates is crucial to maintaining secure and robust web applications.
