PHP has recompiled its official Windows packages for versions 8.2 to 8.5 to address CVE-2026-111497, a vulnerability in the Brotli compression library included in these packages. This vulnerability could allow an attacker to corrupt memory and potentially execute code.
According to PHP, the vulnerability can be exploited via the cURL extension when it automatically decompresses HTTP responses. While cURL does not enable this feature by default, applications and HTTP client libraries have the option to activate it.
The updated packages, identified as 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, were released five days after the updates on October 21 that addressed two PHP2Shell remote code execution vulnerabilities. These packages utilize the same PHP source code, ensuring that previous fixes remain intact, and now incorporate Brotli version 1.2.1, which resolves the issue.
PHP provides a software bill of materials with each package, detailing the components included. For the x64 Non Thread Safe builds of all four versions released last week, the lists indicate Brotli version 1.2.0, which is one of the affected versions.
PHP recommends that Windows users download the new builds from its downloads page. Since the PHP version itself has not changed, executing php -v will yield the same version number before and after the update. The -1 in the filename, such as php-8.5.12-1-nts-Win32-vs17-x64.zip, along with the SHA-256 hash on the downloads page, signifies the new build.
Automatic decompression implies that cURL requests a compressed response from the server and unpacks it. In PHP code, this feature is activated using the CURLOPT_ENCODING option, and an empty value allows for all formats supported by cURL.
According to the code in its 7.16.1 and 8.3.1 releases, Guzzle, a PHP HTTP client library, sets this empty value by default for requests made through cURL. Based on this code and PHP’s description, an application that retains Guzzle’s default settings fulfills the criteria for exploiting the vulnerability in last week’s Windows builds. The Hacker News has not conducted tests on a Windows system.
An attack would involve a specially crafted compressed response from a server that the PHP application interacts with.
Google has rated the vulnerability as 9.2 out of 10, or Critical, on the CVSS 4.0 scale, while Red Hat has assigned it a rating of 8.1, or Important, on the CVSS 3.1 scale.
Researchers from Imperva successfully executed code through the vulnerability on an official Node.js build, although it took multiple attempts. PHP’s announcement does not report any known attacks. CISA’s evaluation on October 23 indicated no exploitation had occurred, and the vulnerability was not listed in its Known Exploited Vulnerabilities catalog as of that day’s update.
The flaw was discovered by researchers at OpenAI. Google addressed it in Brotli versions 1.2.1, 1.1.1, and 1.0.10 when it was first reported on October 21. Other software, including Node.js and Bun, which include their own versions of Brotli, have also issued fixes.
PHP’s announcement does not provide a workaround for systems that are unable to update at this time. OpenAI recommends disabling automatic Brotli decompression in HTTP clients until the update is applied and cautions that simply removing br, Brotli’s designation in the Accept-Encoding header, does not prevent a server from sending it.
In PHP code, adhering to this guidance means not configuring CURLOPT_ENCODING, as cURL will not decompress responses without it. In Guzzle, this entails setting the decode_content request option to false, which halts all automatic decoding, ensuring that gzip responses are also received in their compressed form.
Source: Original article
