PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
This story is only covered by news sources that have yet to be evaluated by the independent media monitoring agencies we use to assess the quality and reliability of news outlets on our platform. Learn more here.6 Articles
6 Articles
PHP for Windows received new builds to fix critical vulnerability CVE-2026-111497 in Brotli, a component used by cURL. The problem may affect applications that use Guzzle to process compact HTTP responses. The recommendation is to update packages, check installed dependencies, and temporarily disable automatic decompression when needed.
The Hacker News
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
Cyber Security News
IT Security News - cybersecurity, infosecurity newsPHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability
The PHP team has released updated Windows builds to fix a serious flaw known as HTTP2Shell. The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, and PHP announced them on October 26, 2026. Each build now includes Brotli 1.2.1, which fixes CVE-2026-111497. Windows users who run PHP should install these packages without delay. The […]
Coverage Details
Bias Distribution
- There is no tracked Bias information for the sources covering this story.
Factuality
To view factuality data please Upgrade to Premium
