PHP Fixes Brotli Code Execution Flaw in Windows Update

Introduction

PHP maintainers have released a second Windows-focused security update in less than a week, rebuilding official Windows packages for PHP versions 8.2 through 8.5 to address a critical vulnerability in the Brotli compression library. The flaw, tracked as CVE-2026-111497, could allow remote attackers to corrupt memory and potentially execute arbitrary code. The issue is particularly concerning because it can be triggered through the widely used cURL extension under certain configurations.

Vulnerability Details

CVE-2026-111497 resides in the Brotli compression library bundled with PHP's official Windows distributions. The vulnerability stems from improper handling of compressed data, which can lead to memory corruption when processing malformed or maliciously crafted Brotli-encoded content. While the flaw requires specific conditions to be exploited, its impact is severe: successful exploitation could result in arbitrary code execution within the context of the PHP process.

The attack vector is most relevant when the cURL extension is configured to automatically decompress HTTP responses. Although cURL disables automatic decompression by default, developers who have explicitly enabled this feature—either through the CURLOPT_ACCEPT_ENCODING option or by setting the Accept-Encoding header manually—may be exposing their applications to risk. Any application that accepts user-supplied URLs or processes untrusted HTTP responses through cURL could be vulnerable if auto-decompression is active.

Who Is Affected

The vulnerability affects only users running PHP on Windows using the official binaries distributed by php.net. Users on Linux, macOS, or other Unix-like systems are not impacted, as they typically compile PHP against system-provided libraries rather than the bundled versions. However, organizations that rely heavily on Windows-based PHP deployments—particularly those running web applications, APIs, or automation scripts—should assess their exposure immediately.

Developers and system administrators should also review their cURL configurations. Even if auto-decompression is not explicitly enabled, third-party libraries or frameworks may activate it under the hood. Applications that fetch remote resources, integrate with external APIs, or process user-submitted content via HTTP are the most likely targets.

What Readers Should Do Now

PHP has already rebuilt and redistributed the affected Windows packages with the vulnerability patched. Organizations running PHP 8.2, 8.3, 8.4, or 8.5 on Windows should download and install the updated binaries from the official PHP website immediately. No workarounds or configuration changes can fully mitigate the risk; upgrading is the only reliable solution.

In addition to upgrading, defenders should audit their cURL usage across all PHP applications. Disable automatic decompression unless absolutely necessary, and ensure that CURLOPT_ACCEPT_ENCODING is not set to enable Brotli unless explicitly required. Implement strict input validation for any user-supplied URLs, and consider isolating PHP processes with limited privileges to reduce the potential impact of exploitation. Monitoring for unusual network activity or unexpected child processes spawned by PHP may also help detect attempted exploitation.

Conclusion

The rapid issuance of two Windows security updates in five days highlights the evolving threat landscape facing PHP deployments. While the immediate fix is straightforward—updating to the latest Windows binaries—organizations must also reassess their cURL configurations and dependency management practices. Proactive patch management, combined with robust input validation and process isolation, remains the best defense against similar vulnerabilities. At Grivyonx Technologies, our AI automation and cloud security services help enterprises streamline these processes, ensuring that security keeps pace with development in modern infrastructures.