← Back to blog

PHP Pushes Emergency Windows Updates for Brotli Code Execution Flaw

PHP has released urgent security updates for Windows installations to patch a critical Brotli compression flaw. The vulnerability could allow remote code execution through the cURL extension.

TL;DR

  • PHP released updated Windows packages for versions 8.2 through 8.5 to address CVE-2026-111497.
  • The flaw resides in the Brotli compression library and may lead to memory corruption and code execution.
  • Attackers can exploit the vulnerability via the cURL extension when it auto-decompresses HTTP responses.
  • While cURL disables auto-decompression by default, some configurations may still be at risk.
  • Organizations using PHP on Windows should update immediately to mitigate potential attacks.

PHP has rolled out critical security fixes for its Windows distributions, addressing a high-severity vulnerability in the widely used Brotli compression library. The issue, tracked as CVE-2026-111497, affects PHP versions 8.2 through 8.5 and could allow attackers to execute arbitrary code.

The flaw lies within the Brotli implementation shipped with PHP’s Windows builds. It can be triggered through the cURL extension when handling compressed HTTP responses. Although cURL does not enable automatic decompression by default, certain server configurations may leave systems exposed to exploitation.

Vulnerability Details

  • CVE-2026-111497 is a memory corruption flaw in the Brotli compression library bundled with PHP's Windows packages.
  • It can be exploited remotely if an application uses the cURL extension with automatic response decompression enabled.
  • Successful exploitation could result in arbitrary code execution, giving attackers control over affected servers.

Recommended Actions

  • Organizations running PHP on Windows should upgrade immediately to the patched versions of 8.2 through 8.5.
  • Review server configurations to ensure cURL does not automatically decompress untrusted HTTP content.
  • Monitor systems for unusual activity that might indicate attempted exploitation of this vulnerability.

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.