The PHP project has issued updated Windows builds to address a severe security issue dubbed “HTTP2Shell.” The fixed versions—PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1—were released on October 26, 2026. These builds include an updated Brotli library (version 1.2.1) to resolve the underlying vulnerability (CVE-2026-111497), and Windows users running PHP are strongly encouraged to install them immediately.
What is HTTP2Shell?
HTTP2Shell emerged from a buffer overrun—specifically, an out-of-bounds write—in Google’s Brotli compression library. The issue was first surfaced in a Node.js update on October 21, and researchers originally referred to it as Node2Shell. Its apparent scope expanded rapidly as many platforms using Brotli were found to be affected. The vulnerability carries a CVSS v4.0 severity score of 9.2 out of 10, reflecting its potential to crash applications, leak memory, or allow remote code execution without authentication.
In PHP, the risk arises when the cURL extension processes Brotli-compressed HTTP responses while automatic response decompression is enabled. That setting is disabled by default in cURL, but it can be activated by applications or HTTP client libraries. The “-1” suffix in the version numbers signifies that these are Windows builds rebuilt with safe updated dependencies; the PHP runtime versions themselves remain the same.
Broader impact and mitigation steps
This is not just a PHP issue. HTTP2Shell has been found in many ecosystems that rely on Brotli: Node.js, .NET, FFmpeg, Apache Arrow, ClickHouse, and some Python packages. To contain the threat, vendors and maintainers are issuing patches, and Microsoft has also released fixes where relevant. Because Brotli is widely reused, simply checking your product’s version number isn’t enough. Some maintainers have backported fixes into older releases, meaning a version that appears outdated might still be protected if it incorporated the patched dependency.
For PHP environments on Windows, administrators should confirm that all hosts are running one of the new “-1” builds, which include Brotli 1.2.1. They should also ensure any bundled Brotli libraries are at least version 1.0.10, 1.1.1, or 1.2.1. If patching immediately isn’t feasible, restricting untrusted Brotli-compressed inputs is a critical interim measure. PHP’s security advisory outlines how HTTP2Shell is exploitable via the cURL extension when auto-decompression is on. Additionally, PHP branch 8.2 is set to reach its end of life on December 31, 2026, making upgrades to more current branches important for long-term security.
HTTP2Shell signals a systemic risk stemming from third-party library dependencies. Even when application version numbers stay constant, underlying components like Brotli can introduce vulnerabilities. Systems that enable automatic decompression of external data are especially exposed.
