PHP has rebuilt its official Windows packages for versions 8.2 through 8.5 to fix a security flaw in the Brotli compression library that could allow attackers to corrupt memory and potentially run code.
CVE-2026-111497 (aka Node2Shell, HTTPS2Shell, Brocolli2Shell, and the Brotlipocalypse) is a Brotli vulnerability that could allow unauthenticated remote code execution through specially crafted compressed data. It affects multiple applications, libraries, and infrastructure tools using Brotli, including Node.js, Python integrations, Bun, Envoy, and Istio.
According to PHP’s maintainers, the flaw can be triggered through PHP’s cURL extension when automatic decompression of HTTP responses is enabled. This feature is off by default but can be turned on by applications.
The updated packages are numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The packages include Brotli 1.2.1, which fixes the issue.
PHP recommends that Windows users download and install the rebuilt packages from its official downloads page. Because the PHP version numbers have not changed, running php -v will not show whether the update is installed. Users should check the package filename and SHA-256 hash instead.
The issue was also addressed in other software that includes its own copy of Brotli, including Node.js and Bun. Users of affected software are recommended to install the relevant updates to stay protected. At the time of writing, there were no reports that the flaw is being exploited in the wild.