In the thrilling world of PHP security updates, our dear friends at PHP decided that five days was far too long to wait for a fix. So, they rolled out yet another Windows security update to address a charming little issue involving the Brotli compression library. It turns out this flaw, identified as CVE-2026-111497, could let hackers run wild with their code execution fantasies.
What’s the flaw? Well, it’s like Brotli decided to play a game of “memory corruption”—and guess who lost? Yep, PHP. This little mishap means attackers might have an opening to unleash some chaos on systems using PHP versions 8.2 to 8.5.
The Grand Announcement
PHP announced newly rebuilt packages (8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1) that came just after their previous “emergency” update to patch two remote code execution flaws. Because nothing says "we’ve got it together" like issuing two updates in one week! They fixed the old issues but, surprise! Now they’ve added a shiny new Brotli version: 1.2.1. Because why not?
All these new builds still reflect the same version number when you check via php -v. You’ll notice it still says the same old number, but surprise! There’s a little -1 in the filename now – because that’s how you know it’s brand new and improved.
What Does This All Mean?
Thanks to the magic of cURL (which PHP users love to use), the flaw might be exploited when HTTP responses are decompressed automatically—a feature that’s turned on by some applications, but not by default. So, if you’ve turned on the cURL extension without thinking about it, congratulations! You’ve just doubled your chances of being a victim in this cybersecurity game show.
Although Google rated it as a Critical flaw (9.2 out of 10), it seems no one has yet taken advantage of this vulnerability. No attacks reported! So, maybe everyone is just too busy patching their systems to get creative with exploits.
What Should You Do?
For PHP Windows users, PHP advises heading over to their downloads page and grabbing the latest builds. Still, it’s hard not to chuckle a little at the absurdity of needing a security update just five days after the last one to fix a different flaw.
And if you can’t update right away? Well, OpenAI suggests disabling automatic Brotli decompression in your HTTP clients. Essentially, turn it off, delete some code, and hope for the best.
In conclusion, folks, PHP is keeping us on our toes. With updates flying in more frequently than a poorly timed joke at a family dinner, it seems they’re committed to ensuring their users stay cautious and confused. Well done, PHP, well done!
