PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
Journalistic Attribution: Reported via The Hacker News for public informational purposes under Fair Use. Read the original primary report →
Copyright of original reporting belongs to The Hacker News. Contact support@cubiqinfotech.com for DMCA inquiries.
