Cybersecurity
PHP rebuilds Windows packages to fix Brotli flaw
PHP rebuilt its Windows builds for versions 8.2 through 8.5 after a flaw in bundled Brotli code, and said the fixed packages preserved earlier remote code execution patches.
- PHP rebuilt its official Windows packages for versions 8.2 through 8.5 to fix CVE-2026-111497 in bundled Brotli code.
- PHP said the issue could be reached through cURL when automatic decompression of HTTP responses was enabled.
- The replacement packages were numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, and they included Brotli 1.2.1.
- Google rated the flaw 9.2 on CVSS 4.0, while Red Hat rated it 8.1 on CVSS 3.1.
- CISA recorded no exploitation on 23 October, and the flaw was not in its Known Exploited Vulnerabilities catalogue at that update.
PHP rebuilt its Windows packages after finding the Brotli flaw in the bundled library. The new files kept the same PHP source, so the fixes from the 21 October releases remained in place, and they now carried Brotli 1.2.1.
PHP said the bug could be reached through cURL when automatic response decompression had been switched on. cURL left that setting off by default, but applications and client libraries could enable it, and Guzzle used the empty encoding value by default for some requests.
A specially formed compressed reply from a contacted server could trigger the flaw. Google scored it 9.2 under CVSS 4.0 and Red Hat scored it 8.1 under CVSS 3.1, while PHP said it knew of no attacks; CISA recorded none on 23 October and did not list it in KEV at that update.
Imperva researchers achieved code execution on one official Node.js build after several attempts. OpenAI identified the flaw, and Google, Node.js, Bun and other projects that bundled Brotli released fixes after the 21 October disclosure. PHP said it had no workaround for unpatched systems, and OpenAI advised disabling automatic Brotli decompression in HTTP clients until an update was installed.
Named in this story
Companies
- Imperva
- researchers ran code through the flaw on one official Node.js build
- OpenAI
- researchers found the flaw and advised disabling automatic Brotli decompression
Organisations
- rated the flaw 9.2 on CVSS 4.0 and issued Brotli fixes
- Red Hat
- rated the flaw 8.1 on CVSS 3.1
Governments and agencies
- CISA
- recorded no exploitation on 23 October and left it out of its Known Exploited Vulnerabilities catalogue
Products and systems
- PHP
- rebuilt official Windows packages for versions 8.2 through 8.5
- Brotli
- the compression library bundled in the Windows packages
- cURL
- decompresses HTTP responses when configured to do so
- Guzzle
- sets cURL's empty encoding option by default in the cited releases
- Node.js
- ships its own copy of Brotli and has released fixes
- Bun
- ships its own copy of Brotli and has released fixes
- Windows
- the platform for the rebuilt PHP packages
How the source tells it
The article read as a plain technical advisory, with severity scores and exploit notes presented as factual detail rather than as emotive framing.
No emotive framing was found in the original.