PHP Releases Second Windows Security Update in Five Days to Fix Critical Brotli Vulnerability

The PHP development team has released another security update for Windows users to address a critical vulnerability in the Brotli compression library that could potentially allow attackers to execute malicious code.

The vulnerability, tracked as CVE-2026-111497, affects the Brotli decompression component included in official PHP Windows distributions.

The latest update comes just five days after PHP released emergency patches for two critical remote code execution vulnerabilities collectively known as PHP2Shell.

What Is CVE-2026-111497?

CVE-2026-111497 is an out-of-bounds write vulnerability affecting the Brotli decompression library.

The flaw can cause memory corruption when an affected application processes specially crafted compressed data.

In certain circumstances, successful exploitation could lead to remote code execution.

Google assigned the vulnerability a CVSS v4.0 score of 9.2 (Critical), while Red Hat rated it 8.1 under CVSS v3.1.

Within PHP Windows environments, the vulnerability can be reached through the cURL extension when automatic HTTP response decompression is enabled.

Although automatic decompression is disabled by default in cURL, PHP applications and third-party HTTP libraries may enable the feature.

How Could Attackers Exploit the Vulnerability?

An attacker could potentially exploit the vulnerability by causing an affected PHP application to process a malicious Brotli-compressed HTTP response.

The attack requires the application to retrieve and automatically decompress content from an attacker-controlled or otherwise compromised server.

Applications using HTTP client libraries such as Guzzle may be exposed because certain configurations enable automatic response decompression.

Successful exploitation could potentially result in:

• Memory corruption
• Application crashes
• Unauthorized code execution
• Compromise of the affected application environment

However, exploitation depends on the application's configuration and how compressed responses are processed.

PHP Releases Updated Windows Builds

The PHP development team has rebuilt its official Windows packages to include Brotli version 1.2.1, which addresses the vulnerability.

The updated versions are:

These builds retain the earlier PHP2Shell security fixes while replacing the vulnerable Brotli component.

Importantly, the PHP source version remains unchanged.

Administrators should verify the updated package filename and SHA-256 checksum rather than relying only on the output of php -v.

Previous PHP2Shell Vulnerabilities Already Patched

On October 21, PHP released emergency security updates addressing two critical vulnerabilities:

• CVE-2026-109618: Remote code execution through out-of-memory handling corruption.
• CVE-2026-109619: Remote code execution involving stale global state.

Both vulnerabilities received CVSS v4.0 scores of 9.2.

Unlike PHP2Shell, the newly addressed Brotli vulnerability originates from a third-party compression library bundled with PHP's Windows packages.

The latest Windows builds address both the earlier PHP2Shell vulnerabilities and the Brotli security issue.

No Confirmed Active Exploitation

As of the October 26 announcement, PHP had not reported confirmed attacks exploiting CVE-2026-111497.

CISA's October 23 assessment also recorded no known exploitation, and the vulnerability was not included in its Known Exploited Vulnerabilities catalog at that time.

Nevertheless, researchers have demonstrated code execution through the underlying Brotli flaw in a separate Node.js environment, indicating that the vulnerability presents a credible security risk.

Temporary Mitigation for Organizations

Organizations unable to install the updated PHP Windows packages immediately should consider disabling automatic Brotli decompression in affected HTTP clients.

Recommended measures include:

• Disable automatic response decompression where operationally possible.
• Review PHP cURL configurations using CURLOPT_ENCODING.
• Configure Guzzle's decode_content option to false where appropriate.
• Avoid processing compressed responses from untrusted sources.
• Monitor PHP security advisories and third-party library updates.

Disabling automatic decoding may affect application functionality, so configuration changes should be tested before production deployment.

Removing Brotli from the Accept-Encoding request header alone is not considered a complete mitigation because a server may still return Brotli-compressed content.

Security Recommendations

Organizations operating PHP applications on Windows should prioritize the following actions:

1. Update PHP Windows builds: Install the latest packages containing Brotli 1.2.1.
2. Verify package integrity: Confirm downloaded files using official SHA-256 checksums.
3. Review HTTP client libraries: Identify applications enabling automatic Brotli decompression.
4. Assess third-party dependencies: Check whether other software components bundle vulnerable Brotli versions.
5. Monitor application behavior: Investigate unusual crashes, memory errors and suspicious outbound HTTP requests.
6. Maintain vulnerability management: Regularly update PHP runtimes and bundled dependencies.

Security Takeaway

The discovery of CVE-2026-111497 demonstrates how vulnerabilities in third-party software libraries can expose applications even after their core runtime has been patched.

Although the vulnerability requires specific conditions for exploitation, the potential for memory corruption and remote code execution makes timely remediation essential.

Organizations running PHP on Windows should install the rebuilt security packages immediately and verify that their environments are no longer using vulnerable Brotli components.