Thehackernews Critical PHP Vulnerability in Brotli Library Requires Urgent Patching
Article Content
- •CVE-2026-111497 is a critical vulnerability in the Brotli library with a CVSS score of 9.2.
- •Affected PHP versions include 8.2 through 8.5, particularly when using the cURL extension.
- •Patches have been released, but many applications may still be vulnerable due to default settings in libraries like Guzzle.
PHP has released a critical security update to address CVE-2026-111497, a vulnerability in the Brotli compression library that could allow remote code execution. This flaw affects PHP Windows packages from versions 8.2 to 8.5 when using the cURL extension to handle compressed HTTP responses. The vulnerability was discovered by OpenAI and has a CVSS score of 9.2, indicating its critical nature. Although automatic decompression is disabled by default in cURL, many applications and libraries, such as Guzzle, enable it, increasing exposure risk. PHP's updates include rebuilt packages with Brotli version 1.2.1, released shortly after previous patches for PHP2Shell vulnerabilities. Microsoft and Cloudflare have also issued updates in response to this vulnerability. Currently, there are no confirmed in-the-wild exploitations, but the potential for exploitation remains high due to the widespread use of Brotli across various platforms.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track CVE-2026-111497 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which PHP versions are affected?
Is there any active exploitation of this vulnerability?
What should I do to protect my systems?
Continue Reading
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like… 
Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both…