Affected Systems

PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 official Windows builds (pre-rebuild). Affects systems using cURL extension with CURLOPT_ENCODING enabled or HTTP client libraries like Guzzle (default behavior) that enable automatic Brotli decompression. Bundled Brotli library versions prior to 1.2.1, 1.1.1, or 1.0.10.

Exploitation Status

No active exploitation reported. CISA assessment (Oct 23) recorded no exploitation; not in KEV catalog. Imperva researchers demonstrated code execution on Node.js build (required multiple attempts). PoC exists but no public attacks observed.

Business Impact

Memory corruption leading to arbitrary code execution when PHP applications process malicious compressed HTTP responses from external servers. Risk elevated for applications using Guzzle HTTP client (versions 7.16.1, 8.3.1) which enables automatic decompression by default. Attack requires attacker-controlled or compromised server sending crafted Brotli-compressed responses. CVSS 9.2 (Critical) per Google; 8.1 (Important) per Red Hat. Windows-only issue in official PHP builds.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Upgrade to rebuilt PHP Windows packages: 8.5.12-1, 8.4.27-1, 8.3.36-1, or 8.2.35-1 from php.net/downloads. Verify SHA-256 hash and -1 suffix in filename (e.g., php-8.5.12-1-nts-Win32-vs17-x64.zip).
  • If immediate patching is not possible, disable automatic Brotli decompression: do not set CURLOPT_ENCODING in PHP cURL code, or set Guzzle decode_content option to false (note: this also disables gzip decompression).
  • Audit PHP applications for use of CURLOPT_ENCODING with empty string or Guzzle HTTP client with default settings, especially those contacting external or untrusted servers.
  • Review application logs for unexpected compressed HTTP responses or cURL decompression errors from external sources during the vulnerability window (Oct 21-26).
  • Verify Brotli library version in deployed PHP builds using software bill of materials (SBOM) published with each package; confirm Brotli 1.2.1 or later is present post-update.