CVE-2026-111497 is a memory‑corruption flaw in the Brotli compression library that can allow an attacker to corrupt memory and potentially run code — and PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to address it.
What PHP changed in the rebuilt Windows packages
PHP published new Windows builds numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 that include Brotli 1.2.1, the fixed Brotli release. These rebuilt packages come five days after the October 21 releases that fixed two PHP2Shell remote code execution flaws; PHP says the rebuilt Windows packages use the same PHP source, so the earlier fixes remain in place.
PHP also publishes a software bill of materials with each package. For last week’s x64 Non Thread Safe builds of all four versions, those BOMs show Brotli 1.2.0 — one of the affected versions — which is why the Windows packages were rebuilt. PHP advises Windows users to install the new builds from its downloads page. Because the PHP version number itself did not change, php -v will show the same version before and after; the new build is identified by the -1 suffix in the filename (for example, php-8.5.12-1-nts-Win32-vs17-x64.zip) and by the SHA-256 hash listed on the downloads page.
How the flaw can be reached: cURL automatic decompression and Guzzle defaults
The vulnerability can be reached through PHP’s cURL extension when the extension decompresses HTTP responses automatically. Automatic decompression means cURL asks the server for a compressed response and unpacks it. In PHP code, the CURLOPT_ENCODING option turns automatic decompression on; an empty value accepts every format cURL supports.
Guzzle, the popular PHP HTTP client library, sets that empty value by default for requests it sends through cURL, according to the code in its 7.16.1 release and in 8.3.1. Based on that code and PHP’s own description, an application that keeps Guzzle’s default settings meets the condition for reaching the flaw on last week’s Windows builds. An attack would come as a crafted compressed response from a server that the PHP application contacts. The Hacker News has not tested this on a Windows system.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSeverity, testing, and observed exploitation
- Google rates the flaw 9.2 out of 10 (Critical) on the CVSS 4.0 scale.
- Red Hat rates it 8.1 out of 10 (Important) on the CVSS 3.1 scale.
- Researchers at OpenAI found the flaw and Google released Brotli fixes — Brotli 1.2.1, 1.1.1 and 1.0.10 — when it was first disclosed on October 21.
- Imperva researchers ran code through the flaw on one official Node.js build and reported that it took several attempts to do so.
- PHP’s notice does not mention any attacks, and CISA’s assessment of October 23 recorded no exploitation; the flaw was not in CISA’s Known Exploited Vulnerabilities catalog as of that update.
Practical steps: installs, workarounds, and temporary mitigations
PHP’s recommendation for Windows users is to install the rebuilt builds from its downloads page. PHP offers no workaround for systems that cannot be updated yet.
OpenAI advises turning off automatic Brotli decompression in HTTP clients until the update is installed and warns that removing br (Brotli’s name in the Accept‑Encoding header) “alone does not stop a server from sending it.” Concretely, in PHP code this means not setting CURLOPT_ENCODING, because cURL does not decompress responses without that option. In Guzzle, OpenAI’s guidance translates to setting the decode_content request option to false, which stops all automatic decoding so gzip responses also arrive compressed.
What this means for PHP developers, enterprises, and HTTP client library maintainers
- PHP developers: Review whether your applications enable cURL automatic decompression (CURLOPT_ENCODING) directly or rely on HTTP client libraries that do so by default. If you cannot update Windows builds immediately, avoid setting CURLOPT_ENCODING or adjust client options as OpenAI recommends.
- Enterprises and IT teams running Windows PHP builds: Prioritize installing the rebuilt php-*-*-1 packages from PHP’s downloads page and verify the new build by the -1 filename suffix and the SHA‑256 hash; note that php -v will not reflect the rebuild because the base PHP version remains unchanged.
- HTTP client library maintainers (including Guzzle authors and downstream maintainers): Reassess defaults that enable automatic decompression and consider documenting mitigation steps; Guzzle’s code in 7.16.1 and 8.3.1 sets an empty CURLOPT_ENCODING by default, which meets the condition for reaching the flaw on affected Windows builds.
PHP’s rebuilt Windows packages close a clear technical path to remote code execution tied to Brotli decompression, but they also underline how a single third‑party component can force urgent rebuilds and behavior changes across libraries and deployments. For now the public record shows fixes in Brotli and rebuilt PHP Windows packages, no confirmed exploitation as of October 23, and specific mitigation advice from OpenAI for teams that cannot immediately update.