{"id":245998,"date":"2026-10-27T05:38:09","date_gmt":"2026-10-27T10:38:09","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/php-issues-second-windows-security-update-in-five-days-to-fix-brotli-code-execution-flaw"},"modified":"2026-10-27T05:38:09","modified_gmt":"2026-10-27T10:38:09","slug":"php-issues-second-windows-security-update-in-five-days-to-fix-brotli-code-execution-flaw","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/php-issues-second-windows-security-update-in-five-days-to-fix-brotli-code-execution-flaw","title":{"rendered":"PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw"},"content":{"rendered":"\n<p>PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix <b><a href=\"https:\/\/thehackernews.com\/2026\/10\/brotli-decoder-flaw-behind-nodejs-rce.html\" target=\"_blank\">CVE-2026\u2013111497<\/a><\/b>, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.<\/p>\n<p><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-26-1\">PHP says<\/a> the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.<\/p>\n<p>The rebuilt packages, numbered 8.5.12\u20131, 8.4.27\u20131, 8.3.36\u20131 and 8.2.35\u20131, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026\u2013111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-245998","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=245998"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245998\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=245998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=245998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=245998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}