PHP has rolled out freshly rebuilt Windows binaries for versions 8.2 through 8.5 to address a critical vulnerability in the Brotli compression library (CVE-2026-111497). This flaw could allow attackers to corrupt memory and execute code when Brotli decompression is triggered via the cURL extension. The built-in automatic decompression can be activated by specifying the CURLOPT_ENCODING option — something many frameworks and HTTP clients enable by default.
What’s Changed and Why It Matters
The new Windows builds—tagged as 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1—replace the vulnerable Brotli version with Brotli 1.2.1, which contains the fix. These are delivered on source versions that include prior patches, such as the “PHP2Shell” remote code execution issues addressed just five days earlier. Users will notice the same PHP version numbers via php -v, but filenames with a -1 suffix and updated SHA-256 checksums make the new builds distinguishable from the flawed ones.
Exposure Paths and Severity
The security risk arises when a PHP application receives a crafted Brotli-compressed HTTP response and automatically decompresses it. Libraries like Guzzle are particularly noteworthy, as they set CURLOPT_ENCODING to an empty value by default, which accepts all compression formats and thus can trigger the vulnerability. If Guzzle’s decode_content option isn’t manually disabled, gzip and other encodings remain affected too.
The flaw has been assessed with a 9.2/10 severity on the CVSS 4.0 scale, marking it as Critical, while a CVSS 3.1 rating from Red Hat places it as Important. Despite its impact potential, there are currently no confirmed exploitations. Authorities like CISA have not yet added it to their Known Exploited Vulnerabilities list, and researchers have not publicly reported successful attacks as of the latest notices.
Recommendations & Actions to Take
Windows users running PHP 8.2–8.5 are strongly urged to download the updated builds from the official site and verify them via the SHA-256 hashes listed. For environments where immediate update isn’t possible, temporary mitigations include disabling Brotli decompression — achieved by avoiding setting CURLOPT_ENCODING in PHP cURL or using Guzzle with decode_content set to false. Just removing Brotli from the Accept-Encoding HTTP header isn’t reliable, since servers can still send Brotli content without that hint.
OpenAI researchers discovered the vulnerability, and Brotli 1.2.1 (alongside patches in related software like Node.js or Bun) contains fixes following public disclosure earlier this week. These updates join the suite of recent hardening measures that began with emergency fixes for the PHP2Shell issues.
Broader Implications
This incident highlights one of the weakest links in modern web stacks: the silent power of compression libraries. Brotli enjoys widespread adoption because of its efficiency, but it also opens subtle attack surfaces when decompression is handled automatically without strict bounds. Applications, client libraries, and frameworks must reexamine defaults that prioritize convenience over security.
This swift second patch in under a week underscores how closely vulnerabilities can stack up, especially in core components like compression engines. Administrators and developers should audit not only PHP’s version but also how HTTP clients are configured in their stacks—defaults baked into Guzzle or cURL could already expose services without visible warning signs.
Staying ahead in this environment means treating library updates as part of regular maintenance—not optional extras. For anyone managing PHP on Windows, especially behind API clients or in microservices communicating over HTTP, verifying both cryptographic hash of new builds and configuration of HTTP client tools should become part of the routine security checklist.
Why This Matters & What to Watch
Automatic decompression defaults are increasingly a target for attackers. Brotli is just the latest example, but similar issues have popped up in other ecosystems. Watch for coordinated fixes in dependent libraries and downstream frameworks. Updates may arrive piecemeal, so understanding how your specific setup handles compression, headers, and decoding is crucial to avoid exposure.
