​Security Update Fixes Remote Code Risk in PHP Windows Compression Library

PHP has released its second set of Windows security updates in five days to address a critical vulnerability in the bundled Brotli compression library that could allow remote attackers to corrupt memory and potentially execute arbitrary code. Tracked as CVE-2026-111497, the security flaw affects official Windows packages across PHP versions 8.2 through 8.5 when handling compressed HTTP responses through the cURL extension. The release comes immediately after emergency patches issued on October 21, 2026, which tackled separate remote code execution issues associated with PHP2Shell, highlighting mounting scrutiny over bundled third-party dependencies in web infrastructure.

​ Rebuilt Windows Builds Address Library Flaw

​The update delivers rebuilt official Windows packages for PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, incorporating Brotli version 1.2.1 to patch the flaw. Because the underlying PHP codebase remains unchanged, standard command-line version checks like “php -v” will display the same core version string before and after the update. System administrators have been advised to inspect file names, verify SHA-256 hashes against official downloads, or check the Software Bill of Materials to ensure the patched packages containing the “-1” suffix are deployed.

​Discovered by researchers at OpenAI, the underlying flaw was initially fixed by Google on October 21 across Brotli versions 1.2.1, 1.1.1, and 1.0.10, triggering subsequent updates in software ecosystems such as Node.js and Bun. Google evaluated the flaw with a CVSS 4.0 severity score of 9.2 out of 10, designating it as Critical, while Red Hat assigned it an 8.1 rating under CVSS 3.1 as an Important issue. While security researchers demonstrated code execution within an official Node.js environment after several attempts, PHP reported no active attacks, and an assessment by the US Cybersecurity and Infrastructure Security Agency dated October 23 noted no confirmed in-the-wild exploitation.

​ Exposure Risks for HTTP Clients and Guzzle

​The security flaw is triggered when an application decompresses incoming HTTP payloads automatically via cURL. While standard cURL configurations leave automatic decompression deactivated by default, popular higher-level HTTP client libraries often enable the feature automatically. Guzzle, a prevalent PHP HTTP client, activates decompression by default in versions 7.16.1 and 8.3.1 through its “decode_content” setting, potentially exposing applications running on vulnerable Windows packages to corrupted or crafted inbound responses.

​A functional attack requires an external server contacted by the application to return a specially crafted, compressed payload that trips the memory corruption flaw during client-side handling. Although Guzzle’s default decompression path on Windows builds has not undergone isolated testing, applications processing external web requests under such configurations remain exposed until updated or reconfigured.

​ Mitigation Steps and Decompression Workarounds

​For environments unable to deploy the rebuilt binaries immediately, security advisories recommend disabling automatic decompression routines entirely. Removing the “br” tag from the client “Accept-Encoding” header is insufficient, as web servers may still return Brotli-compressed data regardless of explicit client preferences.

​Administrators are instructed to avoid configuring the “CURLOPT_ENCODING” directive in raw cURL setups or to explicitly set the “decode_content” parameter to “false” within Guzzle configurations. While this temporary workaround prevents memory corruption by halting automatic decompression, it forces applications to handle compressed HTTP payloads, including gzip data, through separate manual processing until official patched binaries are installed.