CONNECT WITH US
Cyber Security

Cyber Security

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

The Hacker News logo

Published on

Add as a preferred source on Google
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.

PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.

The rebuilt packages, numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.

PHP publishes a software bill of materials, a list of the components inside, with each package. For last week's x64 Non Thread Safe builds of all four versions, those lists show Brotli 1.2.0, one of the affected versions.

PHP advises Windows users to install the new builds from its downloads page. Because the PHP version itself is unchanged, php -v shows the same number before and after. The -1 in the file name, as in php-8.5.12-1-nts-Win32-vs17-x64.zip, and the SHA-256 hash listed on the downloads page identify the new build.

Automatic decompression means cURL asks the server for a compressed response and unpacks it. In PHP code, the CURLOPT_ENCODING option turns it on, and an empty value accepts every format cURL supports.

1.



Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.