The PHP development team has issued new Windows build updates to address a critical vulnerability identified as HTTP2Shell. Announced on October 26, 2026, the updated packages include PHP versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, all incorporating Brotli 1.2.1 to resolve CVE-2026-111497.
Understanding the HTTP2Shell Vulnerability
The vulnerability originates from Google’s Brotli library, a widely-used compression tool that facilitates data decompression. The flaw is classified as an out-of-bounds write, meaning it writes data beyond the allocated memory space. Initially disclosed by Node.js on October 21, the bug was termed Node2Shell, later renamed HTTP2Shell as it was found to impact more software.
Google assigned this issue a CVSS v4.0 score of 9.2, indicating high severity. Depending on the configuration, the flaw could lead to program crashes, unauthorized memory access, or remote code execution.
Impact on PHP Systems
PHP’s advisory details how the flaw manifests on Windows systems. The vulnerable Brotli decoder can be accessed via the cURL extension when HTTP response decompression is enabled. Although this setting is disabled by default in cURL, applications and HTTP client libraries might activate it, increasing risk if Brotli data is sourced from untrusted origins.
The recent PHP updates, marked with a “-1” suffix, reflect a Windows rebuild with updated dependencies, while the PHP runtime versions remain unchanged.
Broader Implications and Recommendations
The HTTP2Shell vulnerability extends beyond PHP, affecting other platforms such as Node.js, Python packages, .NET, FFmpeg, ClickHouse, and Apache Arrow. Microsoft and Python package maintainers have also released patches to mitigate the issue.
Security teams are advised to ensure that all Windows PHP hosts are updated to the new “-1” packages and to verify the security of bundled Brotli libraries. Even if an older version number appears, some vendors may have backported the fix, making the build secure.
Teams unable to patch immediately should isolate untrusted Brotli data from production environments. Further details are available on the official PHP security advisory page and Brotli 1.2.1 release notes on GitHub.
For additional insights, refer to our previous analysis on HTTP2Shell’s impact beyond web traffic, and our coverage on Node.js security updates for affected release lines.
