PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability

The PHP team has released updated Windows builds to fix a serious flaw known as HTTP2Shell. The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, and PHP announced them on October 26, 2026.

Each build now includes Brotli 1.2.1, which fixes CVE-2026-111497. Windows users who run PHP should install these packages without delay.

The flaw sits in Google’s Brotli library, a compression tool that many programs use to unpack data. It is an out-of-bounds write, which means the code writes data past the memory area it was meant to use. Node.js disclosed the bug in its security release on October 21, and researchers first called it Node2Shell.

PHP HTTP2Shell Vulnerability

As more software turned out to be affected, the name changed to HTTP2Shell. Google rates the issue with a CVSS v4.0 score of 9.2 out of 10. Depending on the setup, it can crash a program, expose memory contents, or let code run remotely without a login.

PHP’s own advisory explains how the flaw reaches PHP on Windows. The vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is turned on. This setting is off by default in cURL, according to the libcurl documentation. However, applications and HTTP client libraries can enable it.

A PHP setup is therefore most at risk when it decodes Brotli data from sources it does not trust. The “-1” suffix in the new version numbers marks a Windows rebuild with updated dependencies, and the PHP runtime versions themselves do not change.

Administrators should also check for a separate security release that PHP published on October 21. That release fixed two other critical flaws, CVE-2026-109618 and CVE-2026-109619, which can allow remote code execution without a login. PHP 8.2 will reach end of life on December 31, 2026, so teams still on that branch should plan an upgrade to a supported version.

The bug is not limited to PHP. Researchers have found it in Node.js, Python packages, .NET, FFmpeg, ClickHouse, and Apache Arrow. Microsoft and the maintainers of two Python packages have also shipped patches.

Because so many products reuse Brotli, a version number alone may not show the full picture. Some vendors backport the fix into older releases, so a build can be safe even when its version number looks old.

Security teams should start by confirming that every Windows PHP host runs one of the new -1 packages. They should also check any bundled Brotli libraries, since the fixed upstream versions are 1.0.10, 1.1.1 and 1.2.1.

Teams that cannot patch right away should keep untrusted Brotli input away from production systems. The official PHP security advisory page and the Brotli 1.2.1 release notes on GitHub list the details, and the PHP Windows downloads page hosts the updated packages.

For a wider view of the issue, read our earlier report on how HTTP2Shell reaches beyond web traffic into other software. Our coverage of the Node.js security updates also explains which release lines received fixes.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability appeared first on Cyber Security News.