PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to address a critical security vulnerability in the Brotli compression library.
The flaw, tracked as CVE-2026-111497, can cause memory corruption and potentially allow attackers to execute malicious code when affected applications automatically decompress crafted HTTP responses.
According to PHP’s security announcement, the vulnerability can be triggered through the cURL extension when automatic response decompression is enabled. Although cURL does not enable this behavior by default, applications and HTTP client libraries can turn it on, potentially exposing systems to malicious responses from remote servers.
The updated Windows packages are numbered 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. They were released five days after the October 21 PHP updates that addressed two PHP2Shell remote code execution vulnerabilities. The rebuilt packages use the same PHP source code, meaning the earlier security fixes remain intact, while the bundled Brotli library has been upgraded to version 1.2.1.
PHP’s software bills of materials, which list the components included in each release, showed that the previous x64 Non Thread Safe Windows builds bundled Brotli 1.2.0, an affected version. The rebuilt packages replace the vulnerable component with the corrected release.
PHP is urging Windows users to download the updated packages from its official website. Because the PHP source version has not changed, running php -v will show the same version number before and after the update. Users should instead check the downloaded archive’s filename, which includes the -1 build suffix, and verify its SHA-256 hash against the value published on PHP’s downloads page.
The vulnerability affects applications that automatically decompress HTTP responses. When this feature is enabled, cURL can request compressed content from a server and unpack it automatically. PHP applications can enable this behavior through the CURLOPT_ENCODING option, with an empty value allowing cURL to accept any supported compression format.
The risk also extends to applications using Guzzle, a widely used PHP HTTP client library. According to its source code, Guzzle’s cURL handler enables automatic content decoding by default. Consequently, applications using these default settings on affected Windows builds could meet the conditions required to trigger the vulnerability. The Hacker News reported that it had not independently tested this scenario on Windows.
An attack would involve a malicious or compromised server returning a specially crafted compressed response to a vulnerable PHP application. If the response reaches the affected Brotli decoder under the required conditions, it could trigger memory corruption and potentially lead to code execution.
The vulnerability has received different severity ratings from security organizations. Google assigned it a CVSS 4.0 score of 9.2 out of 10, classified as Critical, while Red Hat rated it 8.1 under CVSS 3.1, classifying it as Important.
Researchers have demonstrated code execution through the flaw in an official Node.js build, although the exploitation required several attempts. PHP’s announcement did not report any attacks exploiting the vulnerability, and CISA’s assessment dated October 23 did not record exploitation at that time. The flaw was also absent from the agency’s Known Exploited Vulnerabilities catalog as of that update.
OpenAI researchers discovered the vulnerability, and Google addressed it in Brotli versions 1.2.1, 1.1.1, and 1.0.10 when the issue was disclosed on October 21. Node.js, Bun, and other software that includes its own Brotli implementation have also released fixes.
For systems that cannot be updated immediately, OpenAI recommends disabling automatic Brotli decompression in HTTP clients until the relevant patches are installed. PHP’s notice does not provide a separate workaround for affected Windows builds.
In PHP applications using cURL directly, developers can avoid setting CURLOPT_ENCODING to prevent automatic response decompression. Applications using Guzzle can set the decode_content request option to false. However, this disables automatic decoding for other supported compression formats as well, meaning responses compressed with gzip may also remain compressed.
Windows users and developers should install the rebuilt PHP packages as soon as possible, especially if their applications make HTTP requests to external services and automatically decode compressed responses. Administrators should also check bundled dependencies and update other applications that include vulnerable versions of Brotli.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
