The update was needed because the October 21 Windows releases still packed an older, vulnerable 1.2.0 version of Google’s Brotli tool, as shown in PHP’s software component lists. The newly built packages, labeled 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, keep the previous security fixes while upgrading Brotli to the safe 1.2.1 version. Because the core PHP version number stays the same when running php -v, system admins must check for the -1 tag in the zip file name and verify the SHA-256 hash on the download page.
Automatic HTTP Decompression in cURL and Guzzle Exposes Apps
In PHP, attackers can trigger this flaw through the cURL extension whenever an application automatically unpacks compressed HTTP responses from an external server. While cURL leaves automatic unpacking turned off by default, developers often turn it on using the CURLOPT_ENCODING setting. Popular HTTP client libraries like Guzzle version 7.16.1 and 8.3.1 enable this setting by default, leaving unpatched Windows apps exposed if they connect to a malicious web server. An attacker could exploit this setup by sending back a specially crafted compressed response that breaks memory during unpacking.
OpenAI Researchers Uncover High-Severity Flaw in Google’s Library
Tracked as CVE-2026-111497, the vulnerability was originally found by OpenAI researchers and disclosed on October 21 alongside fixes in Brotli 1.2.1, 1.1.1, and 1.0.10. Google rates the bug 9.2 out of 10 on the CVSS v4.0 scale, while Red Hat scores it at 8.1 on the CVSS v3.1 scale. Although CISA reported no active attacks in the wild as of October 23, Imperva researchers proved that remote code execution is possible after testing the bug on a Node.js build. Other major platforms that bundle their own copy of Brotli, including Node.js and Bun, have also pushed out security updates.
Admins Advised to Install Rebuilt Packages or Disable Decoding
To stay safe, PHP urges Windows administrators to download and install the rebuilt -1 packages right away. For teams that cannot update immediately, OpenAI recommends turning off automatic Brotli unpacking in web clients, noting that simply dropping the br tag from request headers will not stop servers from sending compressed data. In standard PHP code, developers should avoid setting CURLOPT_ENCODING, while Guzzle users need to set the decode_content option to false. Taking this temporary step blocks all automatic unpacking, meaning standard gzip responses will also arrive in compressed form until the server is patched.
Importance of This Development in Cybersecurity
This incident shows how a single flaw in a shared compression library can quietly put multiple programming languages and web tools at risk. Development teams must pay close attention to software component lists and default settings in third-party libraries like Guzzle that may open hidden attack paths. As web applications rely heavily on automated data transfer, keeping bundled dependencies updated is essential to prevent memory corruption attacks. Let’s refine your stalking skills; go through our Instagram and LinkedIn.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
