CyberSecurity News

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

The Hacker News

· October 26, 2026

AI summary

PHP has released updated Windows packages for versions 8.2 through 8.5 to address a vulnerability in the Brotli compression library. The flaw, identified as CVE-2026-111497, can allow an attacker to corrupt memory and potentially execute code. This issue can be exploited through the cURL extension when it automatically decompresses HTTP responses. By default, the cURL extension has this feature disabled. The update is PHP's second Windows security update in five days.

Vulnerabilities mentioned

CVE-2026-111497

UNKNOWN

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Read the full article at The Hacker Newsthehackernews.com/2026/10/php-issues-second-windows-security.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.