CISA lists CVE-2026-111497 as known exploited, without naming PHP for Windows

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026. The entry classifies the Brotli decoder flaw as known exploited, but does not identify PHP for Windows or cURL as the attack path. CISA says use in ransomware campaigns is unknown. CISA’s catalog entry describes a remote, unauthenticated attacker using a crafted Brotli stream to corrupt decoder state, disclose memory, cause denial of service or potentially execute arbitrary code.

Separately, Moncloa.com reported on October 30 that INCIBE-CERT had issued alert INCIBE-2026-808 on October 29 concerning PHP for Windows. The account describes a conditional route through vulnerable Brotli and cURL automatic decompression.

The reported PHP for Windows exposure path

The October 30 account tied exposure to PHP for Windows branches 8.2 through 8.5 when a build contains affected Brotli and an application uses cURL to automatically decompress a Brotli-compressed HTTP response. It said automatic decompression is disabled by default, but an application or third-party library can enable it.

The account listed Brotli versions 1.0.3 through 1.0.9, 1.1.0 and 1.2.0 as affected. PHP alone does not meet the reported trigger conditions; the relevant combination is a Windows build with affected Brotli and a cURL path that performs automatic decompression.

Reported package updates and interim measure

Moncloa.com reported that PHP for Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 had been rebuilt with Brotli 1.2.1.

The account described disabling cURL automatic decompression as an interim way to reduce exposure to that specific route if an update cannot be applied immediately. That setting does not remove the vulnerable library, so it is not a substitute for a fixed build.