The PHP project has released updated Windows builds to mitigate a serious flaw known as HTTP2Shell. Announced on October 26, 2026, the new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1; each Windows build now includes an updated Brotli library (1.2.1) that fixes CVE-2026-111497. Administrators running PHP on Windows should treat these updates as urgent and apply them promptly.
Release details
The “-1” suffix in the version numbers denotes Windows rebuilds that bundle patched dependencies rather than changes to the PHP runtime itself. The Brotli 1.2.1 update addresses an out-of-bounds write in the compression library — a class of bug that can crash processes, expose memory, or enable remote code execution depending on context. PHP’s October 26 advisory calls out this dependency update and points Windows users to the rebuilt packages on the PHP downloads page.
What is HTTP2Shell?
HTTP2Shell is the public name for a high-severity vulnerability rooted in Google’s Brotli compression library. Google assigns a CVSS v4.0 score of 9.2 to the issue. Researchers originally disclosed the problem in the context of Node.js under the name Node2Shell; as more projects were found vulnerable, the label HTTP2Shell came into wider use. The underlying fault is an out-of-bounds write in Brotli’s decoder.
How the vulnerability reaches PHP on Windows
In PHP on Windows, the vulnerable code path can be exercised through the cURL extension when automatic HTTP response decompression is enabled. libcurl documents that automatic decompression is off by default, but application code or HTTP client libraries may enable it. When Brotli decoding is performed on untrusted input, a vulnerable Brotli decoder can expose a PHP process to the flaw. Because the PHP runtime itself was not changed, the risk stems from the bundled or linked Brotli dependency — which is why the Windows rebuilds ship with updated Brotli binaries.
Other affected projects and mitigations
HTTP2Shell is not limited to PHP. Researchers have found vulnerable Brotli usage in Node.js, various Python packages, .NET, FFmpeg, ClickHouse, and Apache Arrow. Microsoft and maintainers of multiple Python packages have already shipped patches. Upstream fixed Brotli versions include 1.0.10, 1.1.1, and 1.2.1; some vendors may backport fixes into older release lines, so version numbers alone do not always indicate safety.
Additional PHP security updates and lifecycle notes
PHP also published a separate security release on October 21 that fixed two other critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allowing remote code execution without authentication. Teams still running PHP 8.2 should note that branch reaches end of life on December 31, 2026, and plan upgrades to a supported release line.
Practical steps for administrators
Security teams should start by confirming that every Windows-hosted PHP installation has been updated to one of the new -1 packages. Check any bundled or statically linked Brotli libraries in vendor bundles and third-party extensions, since a patched upstream release may be present in an otherwise older build. If a patch cannot be applied immediately, avoid processing Brotli-compressed input from untrusted sources and disable automatic decompression where possible. Official PHP advisories and the Brotli 1.2.1 GitHub release notes contain technical details and download links for the fixed artifacts.
Conclusion
Because Brotli is widely reused across ecosystems, HTTP2Shell’s impact extends beyond web servers into many libraries and media tools. Apply the PHP Windows rebuilds now, verify bundled dependencies, and follow vendor advisories to close this high-severity vector across your stack.
Licensed under CC BY-ND 4.0 International