A week after a pair of PHP vulnerabilities gave everyone and their cybersecurity agency a scare, the PHP Foundation is releasing another vital security fix, but this time it’s not alone.
Companies raced overnight to patch CVE-2026-111497, a critical-severity vulnerability in the widely used Brotli decompression algorithm that could allow attackers to expose sensitive data and execute malicious code remotely.
“The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression,” the Foundation said overnight.
“In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.”
Microsoft also joined the scramble with an out-of-band update to its .NET framework, along with another fix.
“This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm,” the Redmond giant said.
“It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11.”
Cloudflare also took emergency action to update its web application firewall protections.
“This emergency release will add two rules related to the Brotli vulnerability CVE-2026-111497 to the Cloudflare Managed Ruleset,” the company said.
“Both rules will be enabled by default with their action set to Log, providing visibility into matching requests so customers can evaluate the impact before choosing to block them.”
Christiaan Beek, cyber security firm Rapid7’s Vice President of Intelligence, told Cyber Daily that CVE-2026-111497 is a serious issue because of how widely used Brotli is in other technologies and platforms.
“By feeding specially crafted data into vulnerable applications, an attacker could potentially crash services or execute malicious code. In practical terms, that could mean customer-facing applications going offline, critical business processes grinding to a halt, or attackers gaining access to sensitive data and internal systems,” Beek said.
“What makes this particularly concerning is that many organisations may not even know which applications depend on Brotli. A vulnerability in a seemingly insignificant software component could ultimately result in significant financial losses, operational disruption, and reputational damage.
“The actual risk depends on whether attackers can reach the vulnerable functionality.”
The sheer speed at which organisations now need to act to protect themselves and their customers is becoming a critical issue in itself, Beek believes, and one that could lead to serious harm in itself.
“We’ve reached a point where everything seems to be an emergency. And when everything is critical, businesses risk losing sight of what actually matters,” Beek said.
“The real cost isn’t just patching. It’s the constant disruption to operations, the diversion of resources, and the difficult decisions about which business systems deserve immediate attention. Security teams need to translate technical vulnerabilities into business risk. Because attackers don’t care about CVSS scores. They care about what they can compromise, disrupt, or monetise.
“And that’s exactly how we should prioritise our defences.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
