Daily · Article 01 · 5 min read
- Security
PHP rebuilds Windows packages with a Brotli security fix
Official announcement dated October 26; source check October 27 JST
Summary
The PHP team announced rebuilt Windows packages on October 26 with Brotli 1.2.1. The runtime number is unchanged, so operators need the package revision and evidence that the web process uses it.
A server may decompress data while fetching a price list from another service. The Windows packages rebuilt by the PHP team on October 26 fix a component used along that communication path.
Key facts
The PHP team released Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1 to fix CVE-2026-111497. A CVE number identifies a publicly disclosed security flaw. The -1 suffix marks a Windows package rebuilt with updated components; the PHP runtime version stays unchanged. PHP announcement · Downloads
1. When a PHP server reads another server’s reply
A server is a computer that handles a site visitor’s requests and sends back the information they need. PHP runs that work for sites such as WordPress, and its cURL extension is a communication tool for fetching information from other servers. Brotli compresses data to reduce the amount transferred; a decoder expands it into a form the program can read.
Imagine a shop server fetching a price list with automatic decoding enabled. Normally it expands the compressed reply and reads the prices. Here, suppose the external service has been compromised and sends a reply changed by an attacker. Processing that data with an unpatched decoder can reach the flaw.
%% Input path through a fictional compromised price service · based on PHP and cURL documentation
flowchart TD
A["Shop’s Windows PHP server"] -->|"Request prices"| B["Assume a compromised service"]
B -->|"Crafted Brotli reply"| C["cURL: automatic decoding ON"]
C --> D["Unpatched decoder processes data"]The PHP notice says the vulnerable decoder is reachable through cURL when automatic HTTP response decompression is enabled. cURL leaves it off by default, but an application or HTTP client library can enable it. That is why operators should check application settings even if they never enabled it themselves. Automatic decoding option
The cat asks Q&A
The researcherCan this path matter without an upload form on my site?
Pocket NotebookA feature that fetches and decompresses another server’s reply can use this path. In this example, the compromised price service supplies the input. Actual exposure depends on the application passing that data through the vulnerable Brotli decoder.
2. What malformed compressed data can damage
Memory is the working space where a running program temporarily keeps information. This defect can write outside its assigned working area while handling malformed compressed input. Brotli’s developers say version 1.2.1 fixes it; the Node.js notice for the same CVE describes possible crashes, memory disclosure and code execution under suitable conditions. Brotli release · Node.js explanation
Other data, including information a program uses to continue its next operation, can sit nearby. Overwriting that information can make the program stop or do something unintended when it later uses it. The table illustrates this general principle with work areas; it does not reproduce the actual memory layout or a successful exploit of this PHP flaw. CWE security-weakness definition: out-of-bounds write
| Processing case | What happens in working memory | Possible result |
|---|---|---|
| Normal processing | Data stays within its assigned area | Other processing information remains intact; work continues |
| Out-of-bounds write | A write crosses the boundary and overwrites other data or processing information | A crash, memory disclosure or, under suitable conditions, attacker-chosen code execution |
- Processing case
Normal processing
- What happens in working memory
- Data stays within its assigned area
- Possible result
- Other processing information remains intact; work continues
- Processing case
Out-of-bounds write
- What happens in working memory
- A write crosses the boundary and overwrites other data or processing information
- Possible result
- A crash, memory disclosure or, under suitable conditions, attacker-chosen code execution
The cat asks Q&A
- The researcher
How can reading compressed data lead to code running?
Pocket NotebookThe problem is not treating the data as an instruction: a write can overwrite information the program uses to decide what happens next. The result depends on what is damaged and the execution environment. It can also simply crash, so not every memory error becomes code execution.
3. The package changes even if PHP still says 8.4.27
An installation package combines PHP with dependencies such as communication and compression components. These are the corresponding rebuilt official Windows packages.
| PHP runtime version | Replacement Windows package |
|---|---|
| 8.5.12 | 8.5.12-1 |
| 8.4.27 | 8.4.27-1 |
| 8.3.36 | 8.3.36-1 |
| 8.2.35 | 8.2.35-1 |
- PHP runtime version
8.5.12
- Replacement Windows package
- 8.5.12-1
- PHP runtime version
8.4.27
- Replacement Windows package
- 8.4.27-1
- PHP runtime version
8.3.36
- Replacement Windows package
- 8.3.36-1
- PHP runtime version
8.2.35
- Replacement Windows package
- 8.2.35-1
For example, a site using the official Windows PHP 8.4.27 package needs the 8.4.27-1 distribution. The PHP number in an admin screen cannot identify the included Brotli fix, so check the installed package name and revision alongside the supplier’s fix record.
The cat asks Q&A
- The researcher
What should I ask my hosting provider?
Pocket NotebookAsk: “Which package revision and Brotli fix were applied to the PHP serving this site, and how did you confirm the running PHP uses them after replacement?” Downloading the package alone does not show that the site is using the new component.
4. Evidence that the update reached your environment
If you do not know the operating system or installation method, ask the server operator for those first. A host supplying its own package should provide evidence that its distribution includes the fix. The Windows -1 suffix is not a Linux update identifier.
| Check | Evidence to request from the operator |
|---|---|
| What was replaced? | Official Windows package name and revision, or the supplier’s security fix record |
| Did it reach the site? | Brotli version used by the PHP actually serving site requests, and the post-replacement verification result |
| Do existing features still work? | Checks of features in use, such as fetching external data |
- Check
What was replaced?
- Evidence to request from the operator
- Official Windows package name and revision, or the supplier’s security fix record
- Check
Did it reach the site?
- Evidence to request from the operator
- Brotli version used by the PHP actually serving site requests, and the post-replacement verification result
- Check
Do existing features still work?
- Evidence to request from the operator
- Checks of features in use, such as fetching external data
PHP’s cURL information includes the Brotli version in use. An operator can inspect it in the site’s execution environment. Command-line PHP may be a different installation from the PHP serving the site, so the target of the check matters. PHP cURL version information
Before changing the server, secure a backup and select a package matching its existing setup. After replacement, verify that the running web service uses the updated components and that existing features work.
The cat asks Q&A
- The researcher
Does updating WordPress itself replace this component?
Pocket NotebookThe server or hosting operator manages the PHP package separately. Ask that operator for evidence that the PHP-side fix was applied.
To close
Follow the fix into the running site
The same defect previously covered in Node.js’s Brotli update has now been addressed in Windows PHP packages. The useful final answer for an operator is evidence that the PHP serving the site uses the fixed component, beyond a record that a new file was downloaded.
Sources
- PHP announcementphp.net
- Downloadsphp.net
- Automatic decoding optioncurl.se
- Brotli releasegithub.com
- Node.js explanationnodejs.org
- CWE security-weakness definition: out-of-bounds writecwe.mitre.org
- PHP cURL version informationphp.net