PHP rebuilds Windows builds for Brotli flaw CVE-2026-111497, five days after PHP2Shell

Timing: PHP published these Windows builds on 26 October 2026. The PHP2Shell security releases came out on 21 October 2026.

What happened

On 26 October, the PHP team announced new Windows packages: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They bundle Brotli 1.2.1.

Brotli 1.2.1 fixes CVE-2026-111497. It is the out-of-bounds write in the Brotli decoder behind Node2Shell. We covered its spread to other software in Brotli2Shell reaches .NET, FFmpeg, ClickHouse and Arrow.

This is not a new PHP release. PHP says the -1 suffix marks a Windows rebuild with updated dependencies. The PHP source and runtime versions stay the same.

It comes five days after the 21 October releases that fixed the two PHP2Shell flaws. Those fixes were in PHP's own code. This one is in a bundled library, not PHP code, as PHP says on its Mastodon account.

Who is affected

The announcement covers the official PHP for Windows builds from php.net. Only the cURL extension path is named.

PHP says the vulnerable decoder can be reached through cURL when automatic HTTP response decompression is on. That is off by default in cURL. But applications and HTTP client libraries can turn it on.

In practice, that means code that sets the cURL encoding option and then fetches a response an attacker controls. Think of a hostile server, a malicious redirect target, or a network attacker on plain HTTP.

Our own reading, not from PHP: the popular Guzzle client turns this on by default. Its cURL handler sets an empty encoding value when decode_content is true, which is the default. libcurl reads an empty value as "all supported decoders". On these builds, that includes Brotli.

Brotli support in Windows cURL arrived in PHP 8.5.6, 8.4.21, 8.3.31 and 8.2.31, on 7 May 2026, per the php-src NEWS file. The SBOM files of the original 8.5.12 and 8.2.35 Windows zips list Brotli 1.2.0, which is affected. The -1 zips list 1.2.1.

What is confirmed

• Fixed builds: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, on the PHP Windows downloads page.
• Fix: Brotli 1.2.1, per PHP and the build SBOMs.
• CVE: Google, the CNA, covers Brotli 1.0.3 to 1.2.0. It scores it CVSS 4.0 9.2 (Critical).
• Impact, per the CVE: memory corruption, memory disclosure, crash, or "potentially" code execution with a crafted Brotli stream.
• Credit, per the CVE: Khai Tran and Sylvie Mayer, OpenAI Codex Security.
• KEV: not listed (catalog 2026.10.23, checked 26 October).

NVD published the CVE on 22 October. It is still awaiting NVD analysis.

What is not confirmed

PHP gives no PHP-specific severity and published no php-src GitHub advisory for this. It does not claim code execution in PHP. The CVE only says "potentially".

We found no public exploit against PHP. A public PoC exists for Node.js lab setups, listed on our CVE record. We found no report of attacks on PHP.

curl published no advisory for this CVE. The flaw is in Brotli, which libcurl calls.

PHP does not say whether Linux or macOS builds need anything. Those builds use the system Brotli and libcurl, so the fix comes from your OS or image vendor.

What to do

1. On Windows, install the -1 build for your branch: 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1.
2. Check the package, not php -v. The PHP version string does not change. Confirm the zip name, or the Brotli version in its SPDX or CDX file.
3. Restart IIS, Apache, PHP-CGI or any service that loads php_curl.dll.
4. If you did not patch PHP2Shell yet, these builds include those fixes too. They are the same 21 October sources.
5. Bundled stacks: if a product ships its own PHP for Windows, ask its vendor for a rebuild. This step is our advice, not PHP's.
6. Until you update, avoid automatic decompression on fetches from untrusted servers. In Guzzle, that is decode_content set to false. Also our advice, not PHP's.
7. Linux and containers: update the system Brotli package from your distribution.

Sources

• PHP news, Updated PHP Windows builds for Brotli security fix
• PHP on Mastodon, Windows builds post
• PHP Windows downloads
• windows.php.net builds archive
• php-src NEWS for PHP 8.5
• Google Brotli v1.2.1 release
• NVD CVE-2026-111497
• CVE.org record CVE-2026-111497
• libcurl CURLOPT_ACCEPT_ENCODING
• Guzzle CurlFactory source
• CISA KEV catalog