PHP Rebuilds Windows Packages for Critical Brotli Vulnerability

PHP has rebuilt its official Windows packages for PHP 8.2, 8.3, 8.4 and 8.5 to address CVE-2026-111497, a vulnerability in the bundled Brotli compression library. The flaw can corrupt memory and may allow code execution when a PHP application uses cURL to automatically decompress an HTTP response.

The new Windows builds are 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They retain the same PHP source as the releases issued on October 21 for the two PHP2Shell remote-code-execution flaws, while replacing the affected Brotli component with version 1.2.1.

New build number, unchanged PHP version

Administrators cannot rely on php -v to distinguish the refreshed packages: the PHP version shown before and after the update is unchanged. PHP directs Windows users to obtain the new builds from its downloads page and to identify them by the -1 suffix in the archive name and by the published SHA-256 hash.

For example, the updated PHP 8.5 archive is named php-8.5.12-1-nts-Win32-vs17-x64.zip. Software bills of materials for the prior x64 Non Thread Safe packages listed Brotli 1.2.0, an affected release. The updated package inventories instead include the fixed Brotli 1.2.1.

Automatic response decoding creates the exposure path

PHP says the vulnerable code can be reached through its cURL extension when automatic decompression is enabled. In that mode, cURL requests compressed HTTP content and unpacks the server response. cURL does not enable this behaviour by default, but applications and HTTP libraries can turn it on.

In PHP code, setting CURLOPT_ENCODING enables automatic decompression; an empty value permits every encoding cURL supports. Guzzle, a PHP HTTP client library, sets this empty value by default for cURL requests in its 7.16.1 and 8.3.1 releases. On affected Windows builds, an application retaining those defaults therefore meets PHP's stated condition for reaching the flaw.

An attack would require a PHP application to contact a server that returns a crafted compressed response. Google assigned CVE-2026-111497 a 9.2 Critical score under CVSS 4.0, while Red Hat assigned it an 8.1 Important score under CVSS 3.1. PHP's notice does not report active attacks, and CISA's October 23 assessment recorded no exploitation; the vulnerability was not then listed in the Known Exploited Vulnerabilities catalog.

Update first, restrict decoding where necessary

PHP provides no workaround for systems that cannot immediately install the refreshed packages. OpenAI, whose researchers found the flaw, advises disabling automatic Brotli decompression in HTTP clients until an update is in place. Removing br from the Accept-Encoding header alone is not sufficient, because a server can still send Brotli content.

For PHP cURL users, that guidance means not setting CURLOPT_ENCODING. Guzzle users can set the decode_content request option to false, although this disables all automatic decoding and leaves gzip responses compressed as well. Businesses using PHP on Windows should verify the archive suffix and SHA-256 hash, deploy the rebuilt packages, and review HTTP-client decoding settings where the update must wait.