PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

Key Points:

• PHP has rebuilt its official Windows packages for versions 8.2 to 8.5 to fix CVE-2026-111497, a critical flaw in the Brotli compression library that could allow attackers to corrupt memory and potentially execute code.
• The vulnerability can be exploited through the cURL extension's automatic HTTP response decompression, which is off by default but can be enabled by applications or HTTP client libraries like Guzzle.
• The new packages include Brotli 1.2.1, the fixed version, and are identified by a "-1" suffix in the file name and updated SHA-256 hashes; users are advised to download these updated builds from PHP's official site.
• The flaw, rated critical by Google and important by Red Hat, has no known active exploitation according to CISA, but researchers recommend disabling automatic Brotli decompression in HTTP clients as a temporary mitigation.
• To mitigate the risk before updating, PHP developers should avoid setting CURLOPT_ENCODING in cURL or disable automatic decoding in libraries like Guzzle by setting decode_content to false, preventing automatic Brotli and gzip decompression.