PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.
PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.
The rebuilt packages, numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.
PHP publishes a software bill of materials, a list of the components inside, with each package. For last week's x64 Non Thread Safe builds of all four versions, those lists show Brotli 1.2.0, one of the affected versions.
PHP advises Windows users to install the new builds from its downloads page. Because the PHP version itself is unchanged, php -v shows the same number before and after. The -1 in the file name, as in php-8.5.12-1-nts-Win32-vs17-x64.zip, and the SHA-256 hash listed on the downloads page identify the new build.
Automatic decompression means cURL asks the server for a compressed response and unpacks it. In PHP code, the CURLOPT_ENCODING option turns it on, and an empty value accepts every format cURL supports.
Guzzle, a PHP HTTP client library, sets that empty value by default for requests it sends through cURL, according to the code in its 7.16.1 release and in 8.3.1. Based on that code and PHP's own description, an application that keeps Guzzle's default settings meets the condition for reaching the flaw on last week's Windows builds. The Hacker News has not tested this on a Windows system.
An attack would come as a crafted compressed response from a server that the PHP application contacts.
Google rates the flaw 9.2 out of 10, or Critical, on the CVSS 4.0 scale. Red Hat rates it 8.1, or Important, on the CVSS 3.1 scale.
Imperva researchers ran code through the flaw on one official Node.js build, and it took them several attempts. PHP's notice does not mention any attacks. CISA's assessment of October 23 recorded no exploitation, and the flaw was not in its Known Exploited Vulnerabilities catalog as of that day's update.
Researchers at OpenAI found the flaw. Google fixed it in Brotli 1.2.1, 1.1.1 and 1.0.10 when it was first disclosed on October 21. Node.js, Bun and other software that ships its own copy of Brotli have also released fixes.
PHP's notice offers no workaround for systems that cannot be updated yet. OpenAI advises turning off automatic Brotli decompression in HTTP clients until the update is installed, and warns that removing br, Brotli's name in the Accept-Encoding header, "alone does not stop a server from sending it."
In PHP code, following that advice means not setting CURLOPT_ENCODING, because cURL does not decompress responses without it. In Guzzle, it means setting the decode_content request option to false, which stops all automatic decoding, so gzip responses also arrive compressed.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.