Uzha
Sign in
← Today's brief

Security · Updated 26 Oct, 11:15 pm IST

PHP issues second Windows security update to fix Brotli code‑execution flaw

Image: The Hacker News

Why it matters for readers: It shows how a third-party compression library used in PHP can cause serious security issues and why updates matter.

  • PHP rebuilt official Windows packages for PHP 8.2–8.5 to fix CVE-2026-111497 in the Brotli library.1
  • The flaw can let an attacker corrupt memory and potentially run code.1
  • The vulnerability can be reached through the cURL extension when it automatically decompresses HTTP responses.1
  • This is the second Windows security update from PHP in five days addressing related issues.1
  • cURL leaves automatic Brotli decompression off by default, reducing immediate exposure unless enabled.1
SaveAsk about this story
Report a mistake in this summary

Get a brief like this every morning

Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.

Get started