PHP rebuilds Windows packages to fix critical Brotli flaw

Feeds.4Sysops •IT News • October 26, 2026

PHP has rebuilt its official Windows packages for versions 8.2 through 8.5 to fix CVE-2026-111497, a critical flaw in the bundled Brotli compression library. The risk is especially relevant to applications using Guzzle with its default cURL settings, which can enable the vulnerable automatic decompression. The updated packages retain last week’s PHP2Shell fixes and include Brotli 1.2.1. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerability in Brotli Library Requires Urgent Patching PHP has released a critical security update to address CVE-2026-111497, a vulnerability in the Brotli compression library that could allow remote code execution. This flaw affects PHP Windows packages from versions 8.2 to 8.5 when using the cURL extension to handle compressed HTTP responses. The vulnerability was discovered by OpenAI and has a CVSS score of 9.2, indicating its critical nature. Although automatic decompression is disabled by default in cURL, many applications and libraries, such as Guzzle, enable it, increasing exposure risk. PHP's updates include rebuilt packages with Brotli version 1.2.1, released shortly after previous patches for PHP2Shell vulnerabilities. Microsoft and Cloudflare have also issued updates in response to this vulnerability. Currently, there are no confirmed in-the-wild exploitations, but the potential for exploitation remains high due to the widespread use of Brotli across various platforms. 4 sources 72

Extracted Entities

PHP rebuilds Windows packages to fix critical Brotli flaw

The full story

Extracted Entities

CVEs (1)

Platforms (1)

Tools (2)