PHP Issues Second Windows Security Update to Address Brotli Code Execution Vulnerability CVE-2026-111497

PHP has issued a critical security update for Windows packages of PHP 8.2–8.5 to address CVE-2026-111497, a memory corruption vulnerability in the Brotli compression library that allows remote code execution. The flaw is exploitable through the cURL extension when decompressing HTTP responses, though it is disabled by default.

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.

PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but

Read original article