Ethical Hacking News
PHP has issued a Windows security update to address a critical vulnerability in the Brotli compression library, which can allow an attacker to corrupt memory and potentially execute code. The update fixes the CVE-2026-111497 vulnerability, which has been rated as critical by Google and important by Red Hat.
PHP has issued a security update to address a critical vulnerability in the Brotli compression library. The vulnerability can be reached through the cURL extension when decompressing HTTP responses automatically. The flaw can be triggered when an application or HTTP client library sets the CURLOPT_ENCODING option to an empty value. The vulnerability has been confirmed by several organizations, including Google and Red Hat, with a CVSS score of 9.2 and 8.1, respectively. Users are advised to install the new builds from PHP's downloads page to mitigate the risk of exploitation. Turning off automatic Brotli decompression in HTTP clients can also help prevent exploitation of the vulnerability.
PHP, a widely used server-side scripting language, has issued a Windows security update to address a critical vulnerability in the Brotli compression library. The update, which is the second to be issued in five days, aims to fix a flaw in the Brotli compression library that can allow an attacker to corrupt memory and potentially execute code. This vulnerability has been rated as critical by Google and important by Red Hat, with a CVSS score of 9.2 and 8.1, respectively.
The vulnerability, identified as CVE-2026-111497, can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves this option off by default, but applications and HTTP client libraries can turn it on. According to PHP, the flaw can be triggered when an application or HTTP client library sets the CURLOPT_ENCODING option to an empty value, which accepts every format cURL supports.
The vulnerability was first discovered by researchers at OpenAI, who found that the flaw could be exploited by sending a crafted compressed response from a server to a PHP application that contacts the server. The vulnerability was later confirmed by Imperva researchers, who ran code through the flaw on one official Node.js build and found it took several attempts to exploit.
To mitigate this vulnerability, PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to include the fixed version of Brotli 1.2.1. The rebuilt packages, numbered 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. The new builds include the same PHP source as the previous releases, so the fixes for the PHP2Shell flaws stay in place.
PHP advises Windows users to install the new builds from its downloads page. However, because the PHP version itself is unchanged, the php -v command shows the same number before and after. The -1 in the file name and the SHA-256 hash listed on the downloads page identify the new build.
OpenAI advises users to turn off automatic Brotli decompression in HTTP clients until the update is installed, and warns that removing br, Brotli's name in the Accept-Encoding header, "alone does not stop a server from sending it." In PHP code, following this advice means not setting CURLOPT_ENCODING, because cURL does not decompress responses without it. In Guzzle, it means setting the decode_content request option to false, which stops all automatic decoding, so gzip responses also arrive compressed.
The vulnerability has been confirmed by several organizations, including CISA, which recorded no exploitation of the flaw as of October 23. The flaw was not in its Known Exploited Vulnerabilities catalog on that day's update.
In addition to the PHP update, several other software packages have released fixes for the vulnerability, including Node.js, Bun, and Google. The vulnerability has been rated as critical by several organizations, including Google and Red Hat, with a CVSS score of 9.2 and 8.1, respectively.
Overall, the PHP vulnerability patch highlights the importance of keeping software up to date, especially for critical vulnerabilities like this one. Users are advised to install the new builds from PHP's downloads page to mitigate the risk of exploitation.
Related Information:
https://www.ethicalhackingnews.com/articles/PHP-Vulnerability-Patch-Brotli-Code-Execution-Flaw-Fixed-with-Windows-Security-Update-ehn.shtml
https://thehackernews.com/2026/10/php-issues-second-windows-security.html
Published: Mon Oct 26 22:36:58 2026 by llama3.2 3B Q4_K_M
