PHP released a second Windows security update in five days to fix a Brotli flaw that could allow code execution. Here's what you need to know and how to stay safe.
If you run PHP on Windows, you might want to sit down for this one. PHP just pushed out its second Windows security update in five days. That's not a typo—five days. The culprit? A nasty little flaw in the Brotli compression library, tracked as CVE-2026-111497. It's the kind of bug that can corrupt memory and, in the wrong hands, let an attacker run code on your server. Fun stuff, right?
### What Exactly Is the Brotli Flaw?
Brotli is a compression algorithm, similar to gzip but newer and faster. PHP's official Windows packages bundle it in. The problem is that the library has a memory corruption bug. If an attacker can feed a specially crafted compressed response to your app, they might be able to overwrite memory and execute arbitrary code. That's the scary part.
But here's the catch: the flaw is only reachable through the cURL extension when it automatically decompresses HTTP responses. And by default, cURL doesn't do that. So, out of the box, you're probably safe. But how often do you stick to defaults? Exactly.
### Why This Matters for Your Windows Setup
If you're like most developers, you've probably tweaked your cURL settings at some point. Maybe you enabled automatic decompression to save a few lines of code. Or maybe you're using a library that does it for you. Either way, if that setting is on, you're exposed. And since this is the second update in five days, it's clear that PHP isn't messing around. They want this fixed now.
> "The flaw can let an attacker corrupt memory and potentially run code. If you're running PHP on Windows, patch yesterday." — That's the vibe from the PHP team, and honestly, they're right.
### How to Protect Yourself
First things first: update your PHP installation. The patched versions are available for PHP 8.2 through 8.5. If you're on an older version, it's time to upgrade—not just for this flaw, but for all the other security fixes you've been missing.
- **Check your cURL settings:** Look for `CURLOPT_ENCODING` or similar options in your code. If you're setting it to an empty string or `""`, that tells cURL to automatically decompress. Consider whether you really need that.
- **Review your dependencies:** If you're using a framework or library that wraps cURL, check its documentation. It might be enabling decompression by default.
- **Test after updating:** Sometimes patches can break things. Run your test suite to make sure everything still works.
### The Bigger Picture
This isn't just about one flaw. It's a reminder that security is a moving target. PHP is actively maintaining its Windows builds, which is great, but it also means you need to stay on top of updates. Five days, two patches—that's the reality of modern software.
And if you're wondering why this only affects Windows: the flaw is in the bundled Brotli library, and the Windows packages include a version that's vulnerable. Linux and macOS users might have a different story, but it's always worth checking.
So, do yourself a favor: go update PHP. Then check your cURL settings. Your future self will thank you.
