# PHP HTTP2Shell: Critical Brotli Out-of-Bounds Write Reachable via cURL (CVE-2026-111497, CVE-2026-109618, CVE-2026-109619)

> PHP published rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) bundling Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder reachable through the cURL extension when automatic HTTP response decompression is enabled. Depending on configuration it can crash a process, expose memory, or allow remote code execution without authentication. CVE-2026-109618 and CVE-2026-109619 are separate PHP engine memory-safety flaws disclosed the same week.

- **Published:** 2026-10-26T18:06:38Z
- **Last reviewed:** 2026-10-26T18:06:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4473
- **ID:** TL-2026-4473
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111497, CVE-2026-109618, CVE-2026-109619

## Description

CVE-2026-111497 is an out-of-bounds write (CWE-787, with an unchecked return value, CWE-252) in the decoder of Google's Brotli compression library (c/dec/decode.c). NVD lists versions 1.0.3 through 1.2.0 as affected, and fixes shipped in Brotli 1.0.10, 1.1.1 and 1.2.1. NVD scores it CVSS v4.0 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Node.js describes the trigger as a crafted stream that declares only one block type and then contains a block switch. The decoder did not reject this, and the Node.js patch makes it fail immediately on invalid data (new constant BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH). The PHP advisory says the flaw was disclosed on 2026-10-21, originally under the name Node2Shell and later renamed HTTP2Shell as the wider impact emerged.

In PHP on Windows, the vulnerable decoder is reachable through the cURL extension when automatic HTTP response decompression is enabled. That setting is off by default in cURL, but applications and HTTP client libraries can turn it on. The PHP team released Windows package rebuilds on 2026-10-26: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The '-1' suffix marks a rebuild with updated dependencies. The PHP source releases and runtime versions are unchanged. The risk is highest when an application decodes Brotli data from an untrusted or attacker-controlled server. Depending on configuration, impact ranges from a crash (availability) to memory disclosure (confidentiality) to remote code execution.

The same Brotli flaw affects other consumers of the library. Node.js 22.x, 24.x and 26.x bundle it, and fixes shipped in 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older receive no fix. Node.js rates the issue High. GHSA-9v8h-qqgm-4m35 covers the Python brotli and brotlicffi packages (1.0.3-1.2.0, fixed in 1.2.1 and 1.2.1.0). The source article also names .NET, FFmpeg, ClickHouse, Apache Arrow and Microsoft products as downstream; those were not independently verified. A secondary analysis notes that Node.js fetch() decompresses a response automatically when Content-Encoding contains 'br', so a malicious server can force decompression whatever Accept-Encoding the client sent. Servers that accept Content-Encoding: br request bodies (for example Express with body-parser) are also exposed.

CVE-2026-109618 (use of uninitialized request memory after a longjmp() on out-of-memory) and CVE-2026-109619 (global state retaining references to freed request memory) are separate PHP engine memory-safety flaws, not Brotli. They are rated CVSS v4.0 9.2 (v3.1 9.8 and 8.1) and were fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 2026-10-21. Wiz documents them as 'PHP2Shell' with a working unauthenticated RCE proof of concept against WordPress, Drupal and Joomla container images. Wiz does not mention Brotli or HTTP/2. The hunt skeleton grouped them with HTTP2Shell, and they are kept here as related, distinct issues. Siemens RUGGEDCOM APE1808 and Palo Alto Networks PAN-OS are also listed by NVD as affected by these two CVEs.

Exploitation status for the Brotli flaw is disputed in public sources. One advisory aggregator reports that Imperva confirmed code execution on 2026-10-22 through Node.js fetch() and through Express body-parser. Another reports no confirmed exploitation and no verified public proof of concept. A web search could not corroborate the Imperva claim. This record therefore marks exploitability as THEORETICAL and does not assert in-the-wild exploitation. No threat actor, malware family or network IOC is named in any source.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.001 Compromise Software Dependencies and Development Tools
- T1203 Exploitation for Client Execution
- T1212 Exploitation for Credential Access

## Sources

- [PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability](https://cybersecuritynews.com/php-http2shell-vulnerability/)
- [Updated PHP Windows builds for Brotli security fix](https://www.php.net/archive/2026.php#2026-10-26-1)
- [Brotli v1.2.1 release](https://github.com/google/brotli/releases/tag/v1.2.1)
- [NVD: CVE-2026-111497](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-111497)
- [GitHub Advisory GHSA-9v8h-qqgm-4m35 (brotli / brotlicffi)](https://github.com/advisories/GHSA-9v8h-qqgm-4m35)
- [Node.js October 2026 security releases (Konfirmity)](https://www.konfirmity.com/advisories/nodejs-october-2026-security-releases)
- [Node.js v24.22.1 fixes four HIGH CVEs (lilting.ch)](https://lilting.ch/en/articles/nodejs-tls-dns-brotli-security-release)
- [Node.js Security Release: Brotli RCE and TLS Vulnerabilities (SecurityOnline)](https://securityonline.info/nodejs-security-release-october-2026/)
- [NVD: CVE-2026-109618](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-109618)
- [NVD: CVE-2026-109619](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-109619)
- [PHP security advisory GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [Wiz: PHP2Shell PHP RCE analysis](https://www.wiz.io/blog/php2shell-php-rce)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4473