The PHP development group announced on 26 October that it has issued rebuilt Windows binaries to address a severe vulnerability identified as CVE‑2026‑111497. The flaw resides in the Brotli decompression routine and can trigger an out‑of‑bounds write, leading to memory corruption and, in certain circumstances, remote code execution.
The vulnerability becomes exploitable when an application using PHP’s cURL extension enables automatic HTTP response decompression. Although cURL disables this feature by default, many applications and third‑party HTTP client libraries activate it either explicitly or through default configurations. The new Windows packages incorporate Brotli version 1.2.1, which contains the necessary fix.
Technical details of the Brotli decoder issue
Brotli is a compression algorithm widely employed to shrink web payloads. The problem identified by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer occurs during the decompression phase. An invalid block transition is mistakenly treated as a temporary shortage of input data rather than a permanent formatting error. The decoder then proceeds to write data beyond the bounds of an internal buffer, creating an out‑of‑bounds write condition.
Depending on the surrounding execution environment, the resulting memory corruption may cause a simple crash, leak process memory, or enable an attacker to execute arbitrary code. In the PHP context, the risk is limited to scenarios where the PHP runtime acts as an HTTP client: it contacts a remote server, receives a Brotli‑compressed response, and passes that response to the vulnerable decoder.
Because the attack vector requires the ability to influence the compressed payload, security teams are advised to review any workflow that fetches user‑supplied URLs, pulls remote documents, imports feeds, or otherwise communicates with external services. The key assessment questions are whether the deployed software contains the vulnerable Brotli implementation, whether the application invokes it, and whether an attacker can control the compressed data supplied to the decoder.
Broader ecosystem impact and related advisories
The Brotli issue is not confined to PHP. Google’s own Brotli release history shows that versions 1.2.1, 1.1.1 and 1.0.10, released on 21 October, all address the same out‑of‑bounds write vulnerability. Microsoft issued an out‑of‑band .NET security update on 25 October, warning that exposure depends on applications enabling Brotli decompression or explicitly using the decompression APIs on attacker‑controlled input. The .NET Framework itself is not affected.
Similarly, the Envoy proxy project released an advisory that flags deployments with the Brotli decompressor enabled as potentially vulnerable. These parallel disclosures illustrate how a single third‑party library can create a patching cascade across multiple runtimes and platforms.Research from Imperva’s Ron Masas demonstrated a functional proof‑of‑concept exploit against the official Node.js 24.22.0 Linux arm64 image. The exploit succeeded when Brotli‑compressed data was processed either via Node.js’s built‑in fetch() function or through middleware handling incoming request bodies. The vulnerability was mitigated in Node.js 24.22.1, which rejected the same malicious input. While the Node.js findings confirm practical exploitability in that environment, they do not constitute evidence of a working exploit against PHP’s Windows builds.
Earlier in October, the PHP community dealt with a separate set of flaws collectively known as “PHP2Shell” (CVE‑2026‑109618 and CVE‑2026‑109619). Those issues involved out‑of‑memory handling and stale internal request state, and the UK National Cyber Security Centre urged organizations to inventory PHP installations and prioritize remediation. The current Brotli disclosure adds a distinct dependency‑level concern that must be tracked separately.
What administrators should do now
For operators of the official PHP Windows packages, the immediate action is to replace existing installations with the newly released builds that carry the -1 suffix. Although the suffix indicates a rebuild rather than a version bump, the underlying PHP source and runtime version remain unchanged. The replacement packages are available from the official PHP downloads page.
Because the rebuild does not alter the reported PHP version, administrators should verify the exact package name and build identifier rather than relying on version numbers reported by applications or inventory tools. Failure to distinguish the original distribution from the patched one could leave the vulnerable Brotli component in place.
After deployment, it is advisable to restart all services that load the PHP runtime so that the updated Brotli library is loaded into memory. Background workers, scheduled jobs, and any secondary installations that reference the same runtime should also be examined.
In environments where an immediate rollout is not feasible, a temporary mitigation is to disable automatic response decompression in the HTTP client configuration. For cURL, this can be achieved by ensuring that the CURLOPT_ACCEPT_ENCODING option does not request Brotli (the “br” identifier). However, simply omitting “br” from the Accept‑Encoding header does not guarantee that the decoder is unreachable, as servers may return a different content‑encoding than requested.
Frameworks that wrap cURL, such as Guzzle, enable content decoding by default via the decode_content option. Setting this option to false will prevent automatic decompression, but it also changes the shape of the data returned to the application—compressed bytes will be delivered instead of the expected JSON, HTML, or other payloads. Any change to this setting should be tested thoroughly to avoid breaking application logic, and developers must ensure that the compressed data is not subsequently passed to another vulnerable decoder.
Finally, organizations should treat the Brotli fix as a reminder that updating a programming language does not automatically update all bundled libraries. Each runtime, proxy, or platform that embeds Brotli may require its own update path. Checking vendor‑specific remediation guidance and confirming the presence of the patched library in every deployed component remains essential.
By applying the rebuilt Windows packages, verifying deployment, and reviewing HTTP client configurations, security teams can close the immediate exposure presented by CVE‑2026‑111497 while maintaining broader vigilance over shared dependencies.
Be First to Comment