PHP CVE-2026-111497 — paketlarga kiritilgan Brotli siqish kutubxonasidagi kamchilikni tuzatish uchun PHP 8.2 dan 8.5 gacha bo'lgan rasmiy Windows paketlarini qayta qurdi. Bu kamchilik hujumchiga xotirani buzish va ehtimol kodni ijro etish imkonini berishi mumkin.
PHP ma'lumotiga ko'ra, bu kamchilik cURL kengaytmasi HTTP javoblarini avtomatik ravishda siqishdan ochganda yetib boriladi. cURL bu funksiyani sukut bo'yicha o'chirib qo'ygan, ammo ilovalar va HTTP mijoz kutubxonalari uni yoqishi mumkin.
Qayta qurilgan paketlar — 8.5.12-1, 8.4.27-1, 8.3.36-1 va 8.2.35-1 — 21-oktabrda chiqarilgan va PHP2Shell masofaviy kod ijro etish kamchiliklarini tuzatgan relizlardan besh kun keyin keldi. Ular bir xil PHP manba kodidan foydalanadi, shuning uchun avvalgi tuzatishlar saqlanib qoladi, va endi Brotli 1.2.1 — tuzatilgan versiyani o'z ichiga oladi.
PHP har bir paket bilan birga dasturiy materiallar ro'yxatini (software bill of materials) — ichidagi komponentlar ro'yxatini e'lon qiladi. O'tgan haftadagi to'rtta versiyaning x64 Non Thread Safe qurilishlari ro'yxatida Brotli 1.2.0 — ta'sirlangan versiyalardan biri ko'rsatilgan.
PHP Windows foydalanuvchilariga yangi qurilishlarni yuklab olish sahifasidan o'rnatishni tavsiya qiladi. PHP versiyasining o'zi o'zgarmagani uchun, php -v yangilanishdan oldin va keyin bir xil raqamni ko'rsatadi. Fayl nomidagi -1, masalan php-8.5.12-1-nts-Win32-vs17-x64.zip, va yuklab olish sahifasida ko'rsatilgan SHA-256 xesh yangi qurilishni aniqlaydi.
Avtomatik siqishdan ochish degani cURL serverdan siqilgan javobni so'raydi va uni ochadi. PHP kodida CURLOPT_ENCODING opsiyasi uni yoqadi, va bo'sh qiymat cURL qo'llab-quvvatlaydigan har bir formatni qabul qiladi.
PHP HTTP mijoz kutubxonasi Guzzle, 7.16.1 va 8.3.1 relizlaridagi kodga ko'ra, cURL orqali yuboradigan so'rovlar uchun sukut bo'yicha shu bo'sh qiymatni o'rnatadi. Shu kod va PHPning o'z tavsifiga asoslanib, Guzzle'ning sukut sozlamalarini saqlab qolgan ilova o'tgan haftadagi Windows qurilishlarida kamchilikka yetib borish shartini qondiradi. The Hacker News buni Windows tizimida sinab ko'rmagan.
Hujum PHP ilovasi bog'lanadigan serverdan keladigan maxsus tayyorlangan siqilgan javob shaklida keladi.
Google bu kamchilikni CVSS 4.0 shkalasi bo'yicha 10 dan 9.2 — Critical deb baholaydi. Red Hat CVSS 3.1 shkalasi bo'yicha 8.1 — Important deb baholaydi.
Imperva tadqiqotchilari rasmiy Node.js qurilishlaridan birida bu kamchilik orqali kodni ijro etishdi, va bu ularga bir necha urinish talab qildi. PHP e'lonida hech qanday hujumlar haqida aytilmagan. CISAning 23-oktabrdagi baholashida ekspluatatsiya qayd etilmagan, va o'sha kun yangilanishiga ko'ra kamchilik Known Exploited Vulnerabilities katalogida yo'q edi.
Kamchilikni OpenAI tadqiqotchilari topishgan. Google uni Brotli 1.2.1, 1.1.1 va 1.0.10 da tuzatdi, bu 21-oktabrda birinchi marta e'lon qilinganda sodir bo'ldi. Brotli o'z nusxasini o'z ichiga olgan Node.js, Bun va boshqa dasturlar ham tuzatishlarni chiqardi.
PHP e'lonida hali yangilana olmaydigan tizimlar uchun hech qanday vaqtinchalik yechim (workaround) taklif qilinmagan. OpenAI HTTP mijozlarida avtomatik Brotli siqishdan ochishni yangilanish o'rnatilgunga qadar o'chirishni tavsiya qiladi, va br — Brotli nomini Accept-Encoding sarlavhasidan olib tashlash "yolg'iz o'zi serverning uni yuborishini to'xtatmaydi" deb ogohlantiradi.
PHP kodida bu tavsiyaga amal qilish CURLOPT_ENCODING ni o'rnatmaslikni anglatadi, chunki cURL usiz javoblarni siqishdan ochmaydi. Guzzle'da bu decode_content so'rov opsiyasini false ga o'rnatishni anglatadi, bu esa barcha avtomatik dekodlashni to'xtatadi, shuning uchun gzip javoblari ham siqilgan holda keladi.
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.
PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.
The rebuilt packages, numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.
PHP publishes a software bill of materials, a list of the components inside, with each package. For last week's x64 Non Thread Safe builds of all four versions, those lists show Brotli 1.2.0, one of the affected versions.
PHP advises Windows users to install the new builds from its downloads page. Because the PHP version itself is unchanged, php -v shows the same number before and after. The -1 in the file name, as in php-8.5.12-1-nts-Win32-vs17-x64.zip, and the SHA-256 hash listed on the downloads page identify the new build.
Automatic decompression means cURL asks the server for a compressed response and unpacks it. In PHP code, the CURLOPT_ENCODING option turns it on, and an empty value accepts every format cURL supports.
Guzzle, a PHP HTTP client library, sets that empty value by default for requests it sends through cURL, according to the code in its 7.16.1 release and in 8.3.1. Based on that code and PHP's own description, an application that keeps Guzzle's default settings meets the condition for reaching the flaw on last week's Windows builds. The Hacker News has not tested this on a Windows system.
An attack would come as a crafted compressed response from a server that the PHP application contacts.
Google rates the flaw 9.2 out of 10, or Critical, on the CVSS 4.0 scale. Red Hat rates it 8.1, or Important, on the CVSS 3.1 scale.
Imperva researchers ran code through the flaw on one official Node.js build, and it took them several attempts. PHP's notice does not mention any attacks. CISA's assessment of October 23 recorded no exploitation, and the flaw was not in its Known Exploited Vulnerabilities catalog as of that day's update.
Researchers at OpenAI found the flaw. Google fixed it in Brotli 1.2.1, 1.1.1 and 1.0.10 when it was first disclosed on October 21. Node.js, Bun and other software that ships its own copy of Brotli have also released fixes.
PHP's notice offers no workaround for systems that cannot be updated yet. OpenAI advises turning off automatic Brotli decompression in HTTP clients until the update is installed, and warns that removing br, Brotli's name in the Accept-Encoding header, "alone does not stop a server from sending it."
In PHP code, following that advice means not setting CURLOPT_ENCODING, because cURL does not decompress responses without it. In Guzzle, it means setting the decode_content request option to false, which stops all automatic decoding, so gzip responses also arrive compressed.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.