{"id":2979,"date":"2026-10-27T09:35:41","date_gmt":"2026-10-27T09:35:41","guid":{"rendered":"https:\/\/newsraise.com\/in\/2026\/10\/27\/php-windows-brotli-decoder-security-update\/"},"modified":"2026-10-27T09:35:41","modified_gmt":"2026-10-27T09:35:41","slug":"php-windows-brotli-decoder-security-update","status":"publish","type":"post","link":"https:\/\/newsraise.com\/in\/2026\/10\/27\/php-windows-brotli-decoder-security-update\/","title":{"rendered":"PHP Issues Emergency Windows Update for Critical Brotli Decoder Flaw"},"content":{"rendered":"\n<!-- Quick Adsense WordPress Plugin: http:\/\/quickadsense.com\/ -->\n<div class=\"9fece8afa224fd09e54b043d0febfb58\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<!-- NR ATF -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-8898941184964366\"\r\n     data-ad-slot=\"4839033563\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<p>The PHP development group announced on 26\u202fOctober that it has issued rebuilt Windows binaries to address a severe vulnerability identified as CVE\u20112026\u2011111497. The flaw resides in the Brotli decompression routine and can trigger an out\u2011of\u2011bounds write, leading to memory corruption and, in certain circumstances, remote code execution.<\/p>\n<p>The vulnerability becomes exploitable when an application using PHP\u2019s cURL extension enables automatic HTTP response decompression. Although cURL disables this feature by default, many applications and third\u2011party HTTP client libraries activate it either explicitly or through default configurations. The new Windows packages incorporate Brotli version\u202f1.2.1, which contains the necessary fix.<\/p>\n<h2>Technical details of the Brotli decoder issue<\/h2>\n<p>Brotli is a compression algorithm widely employed to shrink web payloads. The problem identified by OpenAI Codex Security researchers Khai\u202fTran and Sylvie\u202fMayer occurs during the decompression phase. An invalid block transition is mistakenly treated as a temporary shortage of input data rather than a permanent formatting error. The decoder then proceeds to write data beyond the bounds of an internal buffer, creating an out\u2011of\u2011bounds write condition.<\/p>\n<p>Depending on the surrounding execution environment, the resulting memory corruption may cause a simple crash, leak process memory, or enable an attacker to execute arbitrary code. In the PHP context, the risk is limited to scenarios where the PHP runtime acts as an HTTP client: it contacts a remote server, receives a Brotli\u2011compressed response, and passes that response to the vulnerable decoder.<\/p>\n<p>Because the attack vector requires the ability to influence the compressed payload, security teams are advised to review any workflow that fetches user\u2011supplied URLs, pulls remote documents, imports feeds, or otherwise communicates with external services. The key assessment questions are whether the deployed software contains the vulnerable Brotli implementation, whether the application invokes it, and whether an attacker can control the compressed data supplied to the decoder.<\/p>\n<h2>Broader ecosystem impact and related advisories<\/h2>\n<p>The Brotli issue is not confined to PHP. Google\u2019s own Brotli release history shows that versions\u202f1.2.1,\u202f1.1.1 and\u202f1.0.10, released on 21\u202fOctober, all address the same out\u2011of\u2011bounds write vulnerability. Microsoft issued an out\u2011of\u2011band .NET security update on 25\u202fOctober, warning that exposure depends on applications enabling Brotli decompression or explicitly using the decompression APIs on attacker\u2011controlled input. The .NET Framework itself is not affected.<\/p>\n<p>Similarly, the Envoy proxy project released an advisory that flags deployments with the Brotli decompressor enabled as potentially vulnerable. These parallel disclosures illustrate how a single third\u2011party library can create a patching cascade across multiple runtimes and platforms.<\/n\n\n<p>Research from Imperva\u2019s Ron\u202fMasas demonstrated a functional proof\u2011of\u2011concept exploit against the official Node.js\u202f24.22.0 Linux arm64 image. The exploit succeeded when Brotli\u2011compressed data was processed either via Node.js\u2019s built\u2011in <code>fetch()<\/code> function or through middleware handling incoming request bodies. The vulnerability was mitigated in Node.js\u202f24.22.1, which rejected the same malicious input. While the Node.js findings confirm practical exploitability in that environment, they do not constitute evidence of a working exploit against PHP\u2019s Windows builds.<\/p>\n<p>Earlier in October, the PHP community dealt with a separate set of flaws collectively known as \u201cPHP2Shell\u201d (CVE\u20112026\u2011109618 and CVE\u20112026\u2011109619). Those issues involved out\u2011of\u2011memory handling and stale internal request state, and the UK National Cyber Security Centre urged organizations to inventory PHP installations and prioritize remediation. The current Brotli disclosure adds a distinct dependency\u2011level concern that must be tracked separately.<\/p>\n<h2>What administrators should do now<\/h2>\n<p>For operators of the official PHP Windows packages, the immediate action is to replace existing installations with the newly released builds that carry the <code>-1<\/code> suffix. Although the suffix indicates a rebuild rather than a version bump, the underlying PHP source and runtime version remain unchanged. The replacement packages are available from the official PHP downloads page.<\/p>\n<p>Because the rebuild does not alter the reported PHP version, administrators should verify the exact package name and build identifier rather than relying on version numbers reported by applications or inventory tools. Failure to distinguish the original distribution from the patched one could leave the vulnerable Brotli component in place.<\/p>\n<p>After deployment, it is advisable to restart all services that load the PHP runtime so that the updated Brotli library is loaded into memory. Background workers, scheduled jobs, and any secondary installations that reference the same runtime should also be examined.<\/p>\n<p>In environments where an immediate rollout is not feasible, a temporary mitigation is to disable automatic response decompression in the HTTP client configuration. For cURL, this can be achieved by ensuring that the <code>CURLOPT_ACCEPT_ENCODING<\/code> option does not request Brotli (the \u201cbr\u201d identifier). However, simply omitting \u201cbr\u201d from the <code>Accept\u2011Encoding<\/code> header does not guarantee that the decoder is unreachable, as servers may return a different content\u2011encoding than requested.<\/p>\n<p>Frameworks that wrap cURL, such as Guzzle, enable content decoding by default via the <code>decode_content<\/code> option. Setting this option to <code>false<\/code> will prevent automatic decompression, but it also changes the shape of the data returned to the application\u2014compressed bytes will be delivered instead of the expected JSON, HTML, or other payloads. Any change to this setting should be tested thoroughly to avoid breaking application logic, and developers must ensure that the compressed data is not subsequently passed to another vulnerable decoder.<\/p>\n<p>Finally, organizations should treat the Brotli fix as a reminder that updating a programming language does not automatically update all bundled libraries. Each runtime, proxy, or platform that embeds Brotli may require its own update path. Checking vendor\u2011specific remediation guidance and confirming the presence of the patched library in every deployed component remains essential.<\/p>\n<p>By applying the rebuilt Windows packages, verifying deployment, and reviewing HTTP client configurations, security teams can close the immediate exposure presented by CVE\u20112026\u2011111497 while maintaining broader vigilance over shared dependencies.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>The PHP team released rebuilt Windows packages on Oct.\u202f26 that patch a critical out\u2011of\u2011bounds write bug in the Brotli decoder used by cURL.<\/p>\n","protected":false},"author":2,"featured_media":2980,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[299],"tags":[3333,3336,3334,3168,2542,3335],"class_list":["post-2979","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-brotli","tag-curl","tag-cve-2026-111497","tag-php","tag-security-update","tag-windows","entry"],"_links":{"self":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts\/2979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/comments?post=2979"}],"version-history":[{"count":0,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts\/2979\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/media\/2980"}],"wp:attachment":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/media?parent=2979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/categories?post=2979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/tags?post=2979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}