PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw (CVE‑2026‑111497)
What It Is — PHP released a second emergency Windows update within five days, addressing CVE‑2026‑111497. The vulnerability resides in the bundled Brotli compression library and can be triggered via the cURL extension when it automatically decompresses HTTP responses. An attacker who can supply a crafted Brotli stream could corrupt memory and achieve arbitrary code execution on the host running the vulnerable PHP binary. The flaw affects the official Windows builds of PHP 8.2 through 8.5. cURL’s automatic decompression is disabled by default, but the vulnerability remains exploitable if an application enables it or if a malicious library is loaded. PHP has published patches for the affected versions and recommends immediate deployment.
Affected Products — PHP 8.2, 8.3, 8.4, 8.5 Windows binary packages (official distribution).
Why It Matters for Trust & Control Assurance — This incident tests the control objective of third‑party component security and timely patch management, a single control that maps to many frameworks (e.g., NIST CSF 2.0). Demonstrating that you have a process to detect, assess, and remediate such upstream library flaws is a core trust signal.
Recommended Actions
- Deploy the latest PHP Windows security update on all affected servers.
- Verify that the cURL extension’s automatic Brotli decompression remains disabled unless explicitly required.
- Inventory all PHP installations and cross‑reference versions against the vendor advisory.
- Integrate the patch status into your continuous monitoring platform to generate defensible evidence for audits.
Source: The Hacker News