PHP has rebuilt its official Windows packages for PHP 8.2 to 8.5 to fix CVE-2026-111497a flaw in the Brotli compression library included in the packages. This flaw can allow an attacker to corrupt memory and potentially execute code.
PHP indicates that the flaw can be reached via the cURL extension when the extension automatically decompresses HTTP responses. cURL leaves this disabled by default, but applications and HTTP client libraries can enable it.
The reconstructed, numbered packages 8.5.12-1, 8.4.27-1, 8.3.36-1 And 8.2.35-1comes five days after the October 21 release that fixed PHP2Shell’s two remote code execution flaws. They use the same PHP source, so these fixes remain in place, and they now include Brotli 1.2.1, the patched version.
PHP publishes a software bill of materials, a list of the components inside, with each package. For last week’s Non Thread Safe x64 releases of all four releases, these lists show Brotli 1.2.0, one of the affected releases.
PHP advises Windows users to install new versions from its download page. Because the PHP version itself is unchanged, php -v shows the same number before and after. THE -1 in the file name, as in php-8.5.12-1-nts-Win32-vs17-x64.zipand the SHA-256 hash listed on the download page identifies the new version.
Automatic decompression means that cURL asks the server for a compressed response and decompresses it. In the PHP code, the CURLOPT_ENCODING The option enables it and an empty value accepts all formats supported by cURL.
Guzzle, a PHP HTTP client library, sets this empty value by default for requests it sends via cURL, according to the code in its version 7.16.1 and version 8.3.1. Based on this code and PHP’s own description, an application that retains Guzzle’s default settings qualifies to hit the flaw in last week’s Windows builds. The Hacker News has not tested this on a Windows system.
An attack would appear in the form of a counterfeit compressed response coming from a server contacted by the PHP application.
Google rates the flaw 9.2 out of 10, or Critical, on the CVSS 4.0 scale. Red Hat gives it a rating of 8.1, or Important, on the CVSS 3.1 scale.
Imperva researchers analyzed the flaw code on an official version of Node.js, and it took them several attempts. PHP’s advisory does not mention any attacks. CISA’s October 23 assessment recorded no exploits, and the flaw was not included in its catalog of known exploited vulnerabilities as of today’s update.
OpenAI researchers found the flaw. Google fixed it in Brotli 1.2.1, 1.1.1 and 1.0.10 when it was first disclosed on October 21. Node.js, Bun, and other software that ships its own copy of Brotli have also released patches.
PHP’s advisory does not offer any workarounds for systems that cannot yet be updated. OpenAI advises disabling automatic Brotli unpacking in HTTP clients until the update is installed, and cautions that removing br, Brotli’s name in the Accept-Encoding header, “does not alone prevent a server from sending it.”
In PHP code, following this advice means not setting CURLOPT_ENCODINGbecause cURL does not decompress responses without it. In Guzzle, this means setting the decode_content request the option of falsewhich stops all automatic decoding, so gzip responses also arrive compressed.
Gn bussni
