thehackernews.com
Oct 26, 2026
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
AI-summarised brief · reviewed before publication
PHP released updated Windows packages for versions 8.2 through 8.5 to patch CVE‑2026‑111497, a Brotli compression flaw that could allow memory corruption and code execution via the cURL extension’s automatic decompression. The new builds, numbered 8.5.12‑1, 8.4.27‑1, 8.3.36‑1, and 8.2.35‑1, incorporate Brotli 1.2.1 and retain earlier PHP2Shell fixes. PHP issued a software bill of materials for each package and urged Windows users to download the revisions. The vulnerability, rated Critical by Google, remains unexploited publicly.
💡 Why It Matters
- · The flaw exposes a high‑severity vector that could let attackers hijack PHP applications on Windows, a platform widely used in web hosting.
- · Prompt patching is essential to prevent potential remote code execution in production environments.
