PHP patches critical CVE-2023-44487 HTTP/2 vulnerability

Key Takeaways

• PHP has issued urgent updates for Windows builds to address CVE-2026-111497, a critical HTTP/2 vulnerability dubbed “HTTP2Shell.”
• The vulnerability resides in Google’s Brotli compression library, specifically version 1.2.1, which is now included in the updated PHP packages.
• Affected PHP versions for Windows include 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, released on October 26, 2026.
• The flaw carries a CVSS v4.0 score of 9.2, enabling potential denial-of-service, information disclosure, or remote code execution.
• Organizations running PHP on Windows are strongly advised to update immediately and review their Brotli handling practices.

PHP Addresses Critical HTTP2Shell Vulnerability in Windows Builds

The PHP development team has released urgent security updates for its Windows builds, specifically targeting a severe vulnerability identified as CVE-2026-111497, known in the security community as “HTTP2Shell.” These critical patches, announced on October 26, 2026, introduce updated packages: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1.

The core of the issue lies within Google’s Brotli compression library, a widely used utility for data decompression. Each of the newly released PHP Windows builds now integrates Brotli version 1.2.1, which contains the fix for CVE-2026-111497. All Windows users operating PHP installations are strongly advised to deploy these updated packages without delay.

Understanding the Brotli Out-of-Bounds Write Flaw

The vulnerability itself is an out-of-bounds write error within the Brotli library. This means that during operation, the code attempts to write data beyond the allocated memory buffer, leading to unpredictable behavior. Initially disclosed by Node.js in its October 21 security release and first dubbed “Node2Shell” by researchers, the scope of affected software quickly expanded, leading to the broader moniker “HTTP2Shell.”

Google has assigned a critical CVSS v4.0 score of 9.2 out of 10 to this vulnerability. Depending on the specific system configuration, successful exploitation of CVE-2026-111497 could result in application crashes, unauthorized exposure of memory contents, or even unauthenticated remote code execution.

Impact on PHP Windows Environments

As PHP’s own advisory explains, the vulnerability manifests in PHP on Windows through the cURL extension. This occurs when automatic HTTP response decompression is enabled, allowing the vulnerable Brotli decoder to process malicious input. While this setting is reportedly disabled by default in libcurl, applications and various HTTP client libraries can explicitly enable it, increasing exposure.

Consequently, PHP setups are most vulnerable when they are configured to decode Brotli data originating from untrusted sources. The “-1” suffix in the new version numbers indicates a specific Windows rebuild incorporating updated dependencies, rather than a change to the core PHP runtime versions themselves.

Broader Context and Mitigation

Beyond this immediate Brotli fix, administrators should also be aware of a separate security release from PHP on October 21, which addressed two other critical remote code execution flaws: CVE-2026-109618 and CVE-2026-109619. Furthermore, with PHP 8.2 nearing its end-of-life on December 31, 2026, teams still utilizing this branch should prioritize upgrading to a currently supported version.

The HTTP2Shell vulnerability is not exclusive to PHP; it has been identified across a wide array of software, including Node.js, Python packages, .NET, FFmpeg, ClickHouse, and Apache Arrow. Microsoft and the maintainers of several Python packages have already deployed their respective patches.

Given the widespread reuse of the Brotli library, simply checking a version number might not provide a complete picture of a system’s security posture. Some vendors backport fixes into older releases, meaning a build might be secure even if its reported version number appears outdated.

What You Should Do

• Immediate Update: Verify that all PHP hosts running on Windows are updated to one of the new “-1” packages (8.5.12-1, 8.4.27-1, 8.3.36-1, or 8.2.35-1). The updated packages are available on the PHP Windows downloads page.
• Review Brotli Libraries: Check any bundled Brotli libraries within your applications, ensuring they are updated to fixed upstream versions 1.0.10, 1.1.1, or 1.2.1. Refer to the Brotli 1.2.1 release notes on GitHub for details.
• Isolate Untrusted Input: If immediate patching is not feasible, implement measures to prevent production systems from processing untrusted Brotli-compressed input.
• Consult Advisories: Regularly review the official PHP security advisory page for the latest information and guidance.
• Plan for EOL: For those still on PHP 8.2, begin planning an upgrade to a supported PHP version before its end-of-life on December 31, 2026.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.