Threat Intelligence

PHP Rebuilds Windows Packages Again to Fix Critical Brotli Flaw

The Hacker News · 27 Oct 2026

Key Takeaway If you run PHP on Windows, install the rebuilt packages from PHP's downloads page and confirm the -1 build name and SHA-256 hash, since the version number will not change.

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. The new builds are numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, and arrive five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. Those earlier fixes remain in place, and the new builds now include Brotli 1.2.1, the fixed version.

PHP says the flaw can be reached through the cURL extension when it automatically decompresses HTTP responses. cURL leaves this off by default, but applications and HTTP client libraries can turn it on. Guzzle, a PHP HTTP client library, sets the relevant option by default in its 7.16.1 and 8.3.1 releases, so applications using Guzzle's defaults appear to meet the condition on last week's Windows builds. The Hacker News has not tested this on Windows. An attack would come as a crafted compressed response from a server the application contacts.

Because the PHP version number is unchanged, php -v looks the same before and after updating. Check for the -1 in the file name and compare the SHA-256 hash on PHP's downloads page. Google rates the flaw 9.2 (Critical) on CVSS 4.0, and Red Hat rates it 8.1 (Important) on CVSS 3.1. PHP's notice mentions no attacks, and CISA recorded no exploitation as of October 23.

PHP Brotli Windows Vulnerability Patching

Primary source cisa.govOfficial source ↗

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.