PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
Summary
PHP has released a second security update for its Windows packages in five days to address a critical vulnerability, CVE-2026-111497, found in the Brotli compression library. This flaw allows attackers to corrupt memory and potentially execute arbitrary code, particularly when the cURL extension is used to decompress HTTP responses.
IFF Assessment
The vulnerability allows attackers to corrupt memory and potentially execute code, which poses a direct threat to systems running vulnerable PHP versions.
Severity
The vulnerability allows for remote code execution via memory corruption, which is a high-impact attack. While default configurations may limit exploitability, the potential for widespread impact on Windows PHP installations warrants a high CVSS score.
Defender Context
This critical vulnerability in the Brotli compression library affects multiple PHP versions on Windows, highlighting the importance of promptly applying security updates. Defenders should ensure their PHP environments are patched and monitor for any exploitation attempts targeting this flaw, especially through the cURL extension.