CriticalMalware
PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability
Cyber Security News·Source published ·1 min read
What happened?
The PHP team has released updated Windows builds to fix a serious flaw known as HTTP2Shell. The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, and PHP announced them on October 26, 2026. Each build now includes Brotli 1.2.1, which fixes CVE-2026-111497. Windows users who run PHP should install these packages without delay. The flaw sits in Google’s Brotli library, a compression tool that many programs use to unpack data. It is an out-of-bounds write, which means the code writes data past the memory area it was meant to use.
Key details
- PHP released updated Windows builds to fix the HTTP2Shell vulnerability in the Brotli library.
- The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, announced on October 26, 2026.
- In PHP on Windows, the vulnerable decoder is reachable via the cURL extension when automatic HTTP response decompression is enabled.
- Automatic decompression is off by default in cURL, but applications and HTTP client libraries can enable it.
- Many other products including Node.js, Python packages, .NET, FFmpeg, ClickHouse, and Apache Arrow are also affected.
Fixes and mitigations
- Check for the separate PHP security release from October 21 that fixed CVE-2026-109618 and CVE-2026-109619.
- Keep untrusted Brotli input away from production systems if immediate patching is not possible.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.