PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

Live updates

1. 1h ago

   PHP Issues Second Windows Security Update in Five Days

   PHP has deployed emergency Windows packages for versions 8.2 through 8.5 to address CVE-2026-111497, a critical out-of-bounds write memory-corruption vulnerability inside the bundled Brotli compression library. This security flaw can allow remote code execution when an application or HTTP client library activates automatic decompression within the cURL extension, although cURL leaves this setting off by default. The newly released packages are numbered 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. These builds incorporate Brotli version 1.2.1 and preserve prior fixes introduced just five days earlier.

   Why it matters

   This security release arrives closely on the heels of patches for previous remote code execution flaws affecting the software. Component dependencies bundled within official distributions frequently introduce secondary attack surfaces that require rapid response from maintainers. Windows administrators face heightened remediation burdens as core libraries demand continuous out-of-cycle package rebuilds.

   What is confirmed

   • PHP issued rebuilt Windows packages for versions 8.2 through 8.5 to fix CVE-2026-111497.
   • The updated package version numbers are 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1.
   • The vulnerability involves an out-of-bounds write in the Brotli compression library.
   • The updated builds include Brotli version 1.2.1.

   Still unconfirmed

   • Node.js and other libraries or applications utilizing HTTP are similarly affected by the Brotli vulnerability or related shell issues.

   What to watch next

   • Additional emergency updates for non-Windows operating systems or other affected ecosystems.
   • Further telemetry regarding active exploitation attempts targeting the Brotli decoder flaw across web environments.
   Sources used for this update (20)

   1. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   2. Amazon Web Services — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
   3. The Atlantic — The Safe Internet Is Shrinking
   4. The New York Times — The 5 Things You Need to Know About the PHP Security Flaw Breaking the Internet
   5. CNN — AI is exposing how fragile the web really is. What you can do to stay safe
   6. Qualys — Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
   7. The Hacker News — PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
   8. wiz.io — Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
   9. Rapid7 — CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
   10. Aikido Security — Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.
   11. Forbes — Microsoft Issues Emergency Patch For Critical Google Algorithm Flaw
   12. Infosecurity Magazine — Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
   confidence 100%