PHP Releases Critical Windows Security Update to Fix Brotli Code Execution Vulnerability

PHP Releases Emergency Security Update for Windows Users PHP has released updated Windows packages to address a critical security vulnerability in the Brotli compression library. Tracked as CVE-2026-111497, the flaw could allow attackers to trigger memory corruption and potentially execute arbitrary code under certain conditions. The security update follows recent PHP releases that addressed separate remote code execution vulnerabilities, making it important for administrators and developers to verify that their Windows-based PHP environments are fully patched. What Is CVE-2026-111497? The vulnerability affects the Brotli compression library, which is used to decompress HTTP responses. In vulnerable builds, specially crafted compressed data may trigger memory corruption and potentially lead to code execution. The issue becomes relevant to PHP applications when the cURL extension automatically decompresses HTTP responses using affected Brotli components. Although automatic decompression is disabled by default in cURL, applications and HTTP client libraries can enable it through their configuration. Which PHP Versions Are Affected? According to the PHP security announcement, updated Windows builds are available for the following branches: PHP 8.5: Build 8.5.12-1 PHP 8.4: Build 8.4.27-1 PHP 8.3: Build 8.3.36-1 PHP 8.2: Build 8.2.35-1 These updated packages include Brotli 1.2.1, which addresses the reported vulnerability. The PHP source version remains unchanged, so the additional -1 build identifier is important when identifying the patched Windows package. Administrators should confirm the exact package they have installed rather than relying only on the PHP version displayed by the command-line interface. How Can the Vulnerability Be Exploited? An attack could involve a PHP application requesting data from a server that returns a specially crafted compressed HTTP response. If the application automatically decompresses that response using a vulnerable Brotli library, processing the data could trigger the vulnerability. Applications using HTTP client libraries such as Guzzle may require particular attention because some configurations enable automatic response decoding by default. Exploitation depends on the affected software build, application configuration, and whether the vulnerable code path can be reached. The vulnerability does not mean every PHP application is automatically exploitable. How to Protect Your PHP Environment System administrators and developers should take the following steps to reduce risk: 1. Update PHP for Windows Download the appropriate patched package from the official PHP downloads page: https://www.php.net/downloads.php?os=windows Verify the package build identifier and SHA-256 checksum before deployment. 2. Identify affected applications Review PHP applications that use cURL or HTTP client libraries to retrieve external content. Pay particular attention to applications that enable automatic response decompression. 3. Apply temporary mitigations if an update is delayed Where immediate patching is not possible, consider disabling automatic response decompression in affected HTTP clients until the patched package can be installed. For direct cURL usage, avoid enabling CURLOPT_ENCODING for affected requests. For Guzzle, the decode_content request option can be set to false to disable automatic decoding. These measures can affect application behavior, including handling of compressed responses, and should be tested before production deployment. Merely removing br from the Accept-Encoding header is not a sufficient security measure. 4. Test and verify the deployment After updating, restart the relevant PHP processes or services as required, confirm that they are loading the patched binaries, and test critical application workflows. Remember that php -v may show the same PHP version before and after this particular Windows package update. Verify the actual installed build and its checksum. Why This Update Matters Compression libraries are commonly used in web applications, APIs, and HTTP clients. A vulnerability in a library bundled with a runtime can therefore affect applications even when their own source code has not changed. Keeping runtime dependencies updated, reviewing HTTP client configurations, and monitoring official security advisories are essential practices for reducing exposure to memory corruption and remote code execution vulnerabilities. Official References PHP Windows downloads: https://www.php.net/downloads.php?os=windows PHP official announcement: https://www.php.net/archive/2026.php#2026-10-26-1 Brotli 1.2.1 release: https://github.com/google/brotli/releases/tag/v1.2.1 CVE details: https://access.redhat.com/security/cve/CVE-2026-111497 Security note: This article is based on the supplied report and linked advisories. Check the official vendor notices for the latest package and mitigation guidance before making production changes.