PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include.
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
OpenAI said it also kicked off a "high-compute red-teaming campaign" to test the resilience of its research and evaluation environments in the face of increasingly powerful models, leading to the discovery of previously unknown software vulnerabilities, including a critical unauthenticated remote code execution in Google Brotli ( CVE-2026-111497 , CVSS score: 9.2), a widely used compression library.
The vulnerability has been reported under several names because it was initially identified in Node.js before researchers found that the same flaw in the Brotli decoder could affect software across multiple ecosystems.
OpenAI, whose Codex Security team reported the flaw, describes it as enabling unauthenticated remote code execution in Brotli and lists Node.js, Bun, and Envoy as affected software.
On Sunday, Microsoft pushed an emergency security update to address the issue in .NET, warning that successful exploitation allows privilege escalation on systems with a vulnerable .NET version.
According to a Microsoft advisory published Sunday, attackers can also exploit this flaw to remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.
Tracked as CVE-2026-111497 , this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm.
OpenAI said the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli." Node.js credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security for reporting the flaw, and maintainers Matteo Collina and Antoine du Hamel for the fix.
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include.
Broccoli2Shell (a.k.a Node2Shell and HTTP2Shell) originates from an out-of-bounds write vulnerability in the Brotli decoder, a widely adopted compression component used to reduce the size of HTTP traffic and other data.
What happened
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
OpenAI said it also kicked off a "high-compute red-teaming campaign" to test the resilience of its research and evaluation environments in the face of increasingly powerful models, leading to the discovery of previously unknown software vulnerabilities, including a critical unauthenticated remote code execution in Google Brotli ( CVE-2026-111497 , CVSS score: 9.2), a widely used compression library.
What changed
The vulnerability has been reported under several names because it was initially identified in Node.js before researchers found that the same flaw in the Brotli decoder could affect software across multiple ecosystems.
OpenAI, whose Codex Security team reported the flaw, describes it as enabling unauthenticated remote code execution in Brotli and lists Node.js, Bun, and Envoy as affected software.
Who is affected
On Sunday, Microsoft pushed an emergency security update to address the issue in .NET, warning that successful exploitation allows privilege escalation on systems with a vulnerable .NET version.
According to a Microsoft advisory published Sunday, attackers can also exploit this flaw to remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.
Why it matters
Tracked as CVE-2026-111497 , this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm.
OpenAI said the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli." Node.js credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security for reporting the flaw, and maintainers Matteo Collina and Antoine du Hamel for the fix.
Technical details
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include.
Broccoli2Shell (a.k.a Node2Shell and HTTP2Shell) originates from an out-of-bounds write vulnerability in the Brotli decoder, a widely adopted compression component used to reduce the size of HTTP traffic and other data.
Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET." To address this flaw, Microsoft has released out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3, and advised "updating as soon as possible." While proof-of-concept (PoC) exploits for Broccoli2Shell have already been published on GitHub, no reports of malicious exploitation in the wild have emerged.
Response
Users of Google Brotli versions 1.0.3 through 1.2.0 also need to update any Brotli libraries or binaries to the latest available version.
Microsoft’s OOB update also addresses CVE-2026-114148, which can allow an authorized attacker to elevate privileges locally by exploiting unsafe ownership metadata in affected .NET tarballs.
What security teams should do
Microsoft released out-of-band updates on October 25 that fix the flaw in .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3.
OpenAI advises turning off automatic Brotli decompression in HTTP clients until the update is installed, and warns that removing br, Brotli's name in the Accept-Encoding header, "alone does not stop a server from sending it." In PHP code, following that advice means not setting CURLOPT_ENCODING , because cURL does not decompress responses without it.
What remains unknown
OpenAI said it also kicked off a "high-compute red-teaming campaign" to test the resilience of its research and evaluation environments in the face of increasingly powerful models, leading to the discovery of previously unknown software vulnerabilities, including a critical unauthenticated remote code execution in Google Brotli ( CVE-2026-111497 , CVSS score: 9.2), a widely used compression library.
Attribution
The Hacker News: PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include.
BleepingComputer: A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
BleepingComputer: Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
The Hacker News: OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.