PHP releases rebuilt Windows packages to fix Brotli flaw

PHP has released a second set of Windows builds for PHP 8.2–8.5 to address a Brotli-based memory corruption flaw tracked as CVE-2026-111497. The rebuilt Windows packages, numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, follow the October 21 fixes for the two PHP2Shell remote code execution flaws and incorporate Brotli 1.2.1. The changes come five days after the initial Brotli patch, and the builds use the same PHP source with the updated Brotli library.

PHP published SBOMs for these Windows packages; the last week’s x64 Non Thread Safe builds listed Brotli 1.2.0, one of the affected versions, in those component lists. The company advises Windows users to install the new builds from its downloads page, noting that the PHP version number shown by php -v remains unchanged.

Evidence and context supplied by PHP and researchers show how the flaw could be exploited: Brotli’s automatic decompression via HTTP responses can be triggered when an application enables automatic decoding of compressed data, for example through CURLOPT_ENCODING or by default in Guzzle’s CurlFactory settings. The vulnerability would present as a crafted compressed response from a server contacted by the PHP application.

CVSS scores place the flaw at 9.2/10 (Critical) per Google, with Red Hat rating it 8.1/10 (Important) on CVSS 3.1. OpenAI researchers demonstrated exploitation in a Node.js build and noted that Node.js, Bun and other software that ships Brotli fixes have followed suit; CISA reported no exploitation as of 23 October. The advisory offers no workaround for systems unable to update, while OpenAI suggests turning off automatic Brotli decompression where feasible until patches are applied.