The PHP development team released updated Windows builds on October 26 to fix CVE-2026-111497, an out-of-bounds write vulnerability in Brotli’s decompression code.
According to PHP’s official announcement, the affected decoder can be reached through PHP’s cURL extension when automatic HTTP response decompression is enabled.
Which Windows Packages Have Been Updated?
A Shared Dependency Creates a Wider Patching TaskGoogle’s Brotli release history lists security fixes in versions 1.2.1, 1.1.1 and 1.0.10, released on October 21.
Its associated advisory says exposure depends on applications enabling Brotli decompression or explicitly using decompression APIs on attacker-controlled input.
The PHP development team released updated Windows builds on October 26 to fix CVE-2026-111497, an out-of-bounds write vulnerability in Brotli’s decompression code. The flaw can cause memory corruption and potentially allow an attacker to execute code when an application processes malicious compressed data.
According to PHP’s official announcement, the affected decoder can be reached through PHP’s cURL extension when automatic HTTP response decompression is enabled. Although cURL disables that functionality by default, applications and HTTP client libraries can activate it. The rebuilt packages incorporate Brotli 1.2.1.
The release highlights a practical challenge for security teams: updating a programming language does not necessarily resolve vulnerabilities in every component distributed with it. A separate dependency update can require another deployment even when the language’s own version number has not changed.
Which Windows Packages Have Been Updated?
PHP published the following replacement builds:
The -1 suffix identifies a Windows package rebuild with refreshed dependencies. The PHP source release and runtime version remain unchanged. Updated packages are available through the official PHP downloads page.
Consequently, administrators need to verify the installed package rather than rely solely on the PHP version reported by an application or inventory tool. A check that only recognises the underlying runtime release may fail to distinguish the original distribution from its replacement.
How Compressed Web Responses Become an Attack Route
Brotli is a compression technology used to reduce the size of data transferred over the web. The security issue arises during decompression, when a receiving application converts compressed content back into its original form.
The Node.js security advisory describes the underlying decoder failure: an invalid block transition can be treated as a temporary shortage of input instead of a permanent formatting error. Processing then continues, allowing data to be written beyond an internal buffer.
Depending on the affected application and execution environment, the resulting memory corruption can cause a crash, expose process memory or enable remote code execution. The advisory credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with reporting the vulnerability.
For PHP, the documented exposure involves the application acting as an HTTP client. It contacts another server, receives a compressed response and passes that response to a vulnerable decoder.
This makes outbound network activity relevant to the investigation. As a practical exposure assessment, teams should examine applications that fetch user-supplied URLs, retrieve remote documents, import feeds or communicate with external services. These are examples of workflows worth reviewing, rather than evidence that every such application is exploitable.
The decisive questions are whether the deployed software contains a vulnerable Brotli implementation, whether the application invokes it, and whether an attacker can influence the compressed data it receives.
Why Default Settings Need Closer Examination
The distinction between cURL’s defaults and an application’s actual behaviour is significant.
The libcurl documentation explains that its CURLOPT_ACCEPT_ENCODING option both sets the requested response encodings and enables automatic decompression. An empty string requests every encoding supported by that build.
It also warns that a server can return a different content encoding from the one requested. Therefore, merely removing br, the identifier for Brotli, from an outgoing Accept-Encoding header should not be treated as proof that Brotli decoding is unreachable.
Application libraries can introduce another layer of configuration. Guzzle’s documentation, for example, lists its decode_content option as enabled by default.
That does not establish that every Guzzle deployment is vulnerable. Exposure still depends on its HTTP handler, the underlying libraries and the data being processed. It does mean that administrators cannot infer an application’s decoding behaviour from cURL’s default configuration alone. Framework settings and HTTP client options also need review.
Researchers Have Demonstrated Code Execution in Node.js
The potential impact extends beyond a theoretical decoder crash.
In research published by Imperva, Ron Masas described a working proof of concept against the official Node.js 24.22.0 Linux arm64 image. The researchers demonstrated execution of code supplied through Brotli-compressed data, while the fixed Node.js 24.22.1 release rejected the same input.
Their testing covered both responses consumed through Node.js’s built-in fetch() function and incoming request bodies processed by configured middleware. Exploitation required multiple attempts in the tested environment.
Those results establish practical exploitation for the configurations examined. They do not establish a working exploit against PHP’s Windows packages, and should not be presented as evidence that all software containing Brotli is equally exploitable. Imperva explicitly limited its findings to the builds and application setups it tested. I
PHP’s October 26 announcement does not report active attacks against its Windows builds. The appropriate distinction is between a confirmed vulnerable component, demonstrated exploitation in a particular runtime, and evidence of attacks against deployed PHP systems.
A Shared Dependency Creates a Wider Patching Task
Google’s Brotli release history lists security fixes in versions 1.2.1, 1.1.1 and 1.0.10, released on October 21. The release notes identify CVE-2026-111497 as an out-of-bounds write capable of permitting remote code execution.
Other projects have also issued updates or advisories for the same dependency.
Microsoft published an out-of-band .NET security update on October 25. Its associated advisory says exposure depends on applications enabling Brotli decompression or explicitly using decompression APIs on attacker-controlled input. Microsoft states that .NET Framework is unaffected.
The Envoy project’s advisory similarly identifies deployments with the Brotli decompressor configured as the relevant exposure.
These disclosures show why the response cannot stop at a single PHP installation. Organisations using several runtimes, proxies or application platforms may have multiple copies of the same library, each maintained through a different update process.
Operationally, an operating-system package update should not be assumed to replace a component embedded inside a separate runtime or vendor-distributed application. Each supplier’s remediation guidance needs to be checked against the software actually deployed.
The Update Is Separate From PHP2Shell
The Windows rebuilds arrive five days after the October 21 security releases addressing CVE-2026-109618 and CVE-2026-109619, the vulnerabilities collectively known as PHP2Shell.
The UK National Cyber Security Centre’s alert describes those earlier issues as flaws involving out-of-memory handling and stale internal request state. Under certain conditions, they can lead to unauthenticated remote code execution.
The NCSC urged organisations to identify PHP installations across their infrastructure, prioritise exposed systems and monitor updates from suppliers whose products bundle PHP.
The Brotli disclosure adds a separate dependency issue to that response. Teams should track the vulnerabilities individually so that completing one remediation task does not prematurely close the others.
It also illustrates the limitations of broad patch-status labels. A system marked “PHP updated” after an earlier deployment may still require further attention when a bundled library receives a fix.
What Administrators Should Do Now
For organisations using the official Windows packages, the immediate priority is to deploy the replacement build appropriate to their PHP branch and verify the package’s identity.
A practical rollout should also include checking application compatibility, restarting affected processes so they load the updated components, and confirming that background workers, scheduled jobs and secondary installations use the intended runtime.
Where deployment cannot be completed immediately, temporarily disabling automatic response decompression can remove the documented decoding path, provided the change is applied throughout the relevant client configuration.
Guzzle documents that setting decode_content to false leaves response bodies undecoded. That can change application behaviour: code expecting decompressed JSON, HTML or other content may instead receive compressed bytes. Such changes require testing, and passing those bytes to another vulnerable decoder would leave the underlying problem unresolved.
For security teams, the wider lesson is to verify the component that was replaced, the application path that could reach it and the deployment that now contains the fix. Runtime version numbers remain useful inventory data, but this release demonstrates why they cannot always serve as the sole evidence that remediation is complete.
