Skepra

Skepra / Web recovery & resilience

PHP Windows builds: Brotli decompression vulnerability — CVE-2026-111497.

On 26 October 2026 the PHP project released updated Windows builds fixing an out-of-bounds write in Brotli decompression, reachable through PHP's cURL extension.

Ask whether this applies to your site

What was published

CVE-2026-111497 is an out-of-bounds write in Brotli 1.2.1 decompression. On PHP Windows builds it can be reached through the cURL extension when an application enables automatic HTTP response decompression—disabled by default in cURL, but sometimes enabled by application or HTTP client code.

Affected versions

PHP Windows builds prior to 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1.

How to check if this applies to your site

This only matters if your site or its server runs PHP on Windows, which is uncommon for most WordPress/WooCommerce hosting. Ask your host whether the server is Windows-based and, if so, whether its PHP build has been updated past the versions above.