Our takePHP has rebuilt its official Windows packages for 8.2–8.5 to fix the Brotli out-of-bounds write (CVE-2026-111497) reachable via cURL auto-decompression. Update the Windows PHP installs you control.Security Resilience desk
Sources (5)
- hackernews · hackernews
- the420_in · the420_in
- helpnet · helpnet
- bleeping · bleeping
- cccs · cccs
What this means for you — Security leader:Update PHP 8.2–8.5 Windows packages immediately; the Brotli flaw (CVE-2026-111497) is under active exploitation per CISA. If you use the cURL extension with automatic decompression, treat this as urgent.
What this means for you — Lean IT orgs:If you run PHP on Windows servers, install the latest PHP 8.2–8.5 packages from the official site today. The built-in compression library has a code-execution bug that attackers are already using.
What this means for you — MSP:Check every Windows PHP 8.2–8.5 instance you manage and push the rebuilt packages; CISA confirms active exploitation of the Brotli flaw reachable via cURL. Prioritize clients running web apps or APIs.
What this means for you — Researcher:CVE-2026-111497 is a Brotli out-of-bounds write reachable in PHP Windows builds via cURL auto-decompression; CISA lists active exploitation. Second rebuild in five days indicates upstream urgency.