As cited
Copy frozen at (site build).
vulnerabilities
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP released patched Windows binaries for versions 8.2 through 8.5 to address CVE-2026-111497, a remote code execution (RCE) vulnerability in the bundled Brotli compression library. The flaw can be exploited via the cURL extension when automatic HTTP response decompression is enabled, allowing memory corruption and potential code execution.
Why it matters: Windows users running PHP 8.2 through 8.5 with cURL automatic decompression enabled must rebuild or update their packages immediately; this CVSS 9.2 vulnerability enables unauthenticated RCE through HTTP responses.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP released updated Windows packages for versions 8.2 through 8.5 to address CVE-2026-111497, a remote code execution (RCE) vulnerability in the bundled Brotli compression library. The flaw can be triggered through the cURL extension when automatic HTTP response decompression is enabled, allowing an attacker to corrupt memory and execute arbitrary code.
Why it matters: Windows users running PHP 8.2 through 8.5 should update immediately, as this CVSS 9.2 flaw enables RCE if Brotli decompression is active in cURL; practitioners should verify whether their installations use automatic decompression and prioritize patching accordingly.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP released updated Windows packages for versions 8.2 through 8.5 to address CVE-2026-111497, a memory corruption flaw in the included Brotli compression library that could permit remote code execution (RCE). The vulnerability is reachable through the cURL extension when automatic HTTP response decompression is enabled, though this feature is off by default.
Why it matters: Windows users running PHP 8.2 to 8.5 with cURL automatic decompression enabled face remote code execution risk and should update immediately; others should verify their cURL configuration.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP released rebuilt Windows packages for versions 8.2 through 8.5 to address CVE-2026-111497, a critical flaw in the bundled Brotli compression library that can enable remote code execution (RCE) through memory corruption. The vulnerability is reachable via the cURL extension when automatic HTTP response decompression is enabled, though this feature is disabled by default.
Why it matters: Windows users running PHP 8.2 through 8.5 with cURL decompression enabled face remote code execution risk and should apply the rebuild immediately; all other users should still patch to remove the attack surface.
- Source published
- First seen by Cybersecurity Tracker