PHP has issued another round of Windows security updates to address a critical vulnerability in the Brotli compression library bundled with official PHP packages. Tracked as CVE-2026-111497, the flaw could allow remote attackers to trigger memory corruption and potentially execute arbitrary code under specific conditions.
The update, released on October 26, 2026, follows emergency PHP security patches issued on October 21. Together, these developments highlight the security risks associated with third-party libraries integrated into widely used web development environments.
Rebuilt Windows Packages Address the Vulnerability
The latest release provides rebuilt official Windows packages for four PHP branches:
PHP 8.5.12-1
PHP 8.4.27-1
PHP 8.3.36-1
PHP 8.2.35-1
According to the supplied report, the updated packages incorporate Brotli version 1.2.1, which addresses the underlying vulnerability.
Because the PHP codebase itself has not changed, running the standard php -v command may display the same core PHP version before and after the update. Administrators therefore need to verify the actual package deployed rather than relying solely on the version string.
The report recommends checking official package filenames, verifying SHA-256 checksums against the published downloads, or consulting the Software Bill of Materials (SBOM) to confirm that the rebuilt packages with the -1 suffix are installed.
What Is CVE-2026-111497?
The vulnerability affects the handling of Brotli-compressed HTTP responses through PHP's cURL extension on Windows. Under the relevant conditions, a specially crafted compressed response could trigger memory corruption and potentially lead to arbitrary code execution.
Researchers at OpenAI reportedly discovered the underlying flaw. Google addressed it on October 21 in Brotli versions 1.2.1, 1.1.1 and 1.0.10, prompting updates across other software ecosystems, including Node.js and Bun.
Severity assessments differ according to the scoring system used. Google reportedly assigned a CVSS 4.0 score of 9.2 out of 10, classifying the issue as Critical, while Red Hat assigned an 8.1 rating under CVSS 3.1 and classified it as Important.
The supplied report also states that researchers demonstrated code execution in an official Node.js environment after several attempts. However, PHP reported no active attacks, and a US Cybersecurity and Infrastructure Security Agency assessment dated October 23 reportedly found no confirmed exploitation in the wild.
How HTTP Clients and Guzzle May Increase Exposure
The flaw becomes relevant when an application automatically decompresses incoming HTTP data through cURL. Standard cURL configurations reportedly leave automatic decompression disabled by default, but higher-level HTTP client libraries may enable it automatically.
One example is Guzzle, a widely used HTTP client for PHP. According to the supplied report, versions 7.16.1 and 8.3.1 enable decompression by default through the decode_content setting.
Applications using these configurations on vulnerable Windows PHP packages could therefore face exposure when they process a specially crafted Brotli-compressed response from an external server.
The risk depends on the application's configuration and the conditions under which the response is handled. The report notes that Guzzle's default decompression path on Windows has not been independently tested in isolation.
For organisations managing web applications, reviewing software dependencies and their configurations is an important part of broader internal audit and control reviews, particularly where third-party components handle external data or sensitive operations.
Recommended Mitigation Measures
Administrators should prioritise installing the rebuilt Windows packages from official PHP distribution sources and verifying that the patched binaries are actually deployed.
For systems that cannot be updated immediately, the report describes temporary workarounds intended to prevent automatic decompression from triggering the vulnerable code path.
These include:
Avoid setting CURLOPT_ENCODING in raw cURL configurations where doing so enables automatic decompression.
Set Guzzle's decode_content option to false where appropriate.
Do not rely solely on removing br from the Accept-Encoding header, as a server may still return Brotli-compressed content.
Disabling automatic decompression can affect how applications process HTTP responses. Administrators may need to handle compressed content separately, including gzip data, until the patched binaries are installed. Any workaround should be tested against the application's requirements.
Why the Update Matters
The PHP update illustrates how vulnerabilities in shared libraries can affect applications even when the main programming language runtime has not changed. It also shows why version checks alone may not always establish whether a security fix has been applied.
Development teams should maintain an inventory of runtime packages, verify vendor checksums, review dependency versions and test mitigations before deploying them to production environments.
The key priority is to verify and deploy the corrected Windows packages. Although the supplied report does not identify confirmed active exploitation against PHP, the potential impact of the vulnerability makes timely patching and configuration review important.