A flaw in the component that unpacks Brotli-compressed data has forced PHP to ship its second Windows security update in five days, and the repair is spreading outward through the software that depends on that same decoder. The defect, tracked as CVE-2026-111497, lets the decoder write data to memory it was never meant to reach, a weakness that can sometimes be turned into running an attacker's code. As the problem has grown, its name has changed from Node2Shell to HTTP2Shell, a sign that the exposure reaches anything handling web traffic, not just one runtime. What remains unsettled is how fa
PHP Ships Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
A flaw in shared plumbing doesn't stay in one place.
Mark
Why does a second PHP update in five days stand out?
Mimi
Because it suggests the problem wasn't contained by the first release. The flaw sits in the Brotli decoder, which is shared plumbing, so fixing one place doesn't settle it.
Mark
What is the flaw, in plain terms?
Mimi
An out-of-bounds write. The decoder can be made to write data outside the memory it should use, and that can lead to code execution.
Luke
Careful, though. We know it's described as critical and as enabling code execution. We don't have details on how easy it is to trigger.
Mark
Why are there so many names for it?
Mimi
Different researchers label it differently. Broccoli2shell from Wiz, Node2Shell, and now HTTP2Shell from Aikido, because HTTP-handling libraries and apps are affected too.
Luke
Names aren't confirmation of scope, though. Each is one firm's framing, and the sources here are headlines, not full advisories.
Mark
Is anyone exploiting it?
Luke
Nothing in what we have says so. That's unknown, not a no.
Mimi
What's clear is the patching: PHP on Windows, Node.js, Python packages and Microsoft ones, according to SecurityWeek.
Mark
So what should readers watch?
Mimi
More updates as other packages catch up, and any word on active attacks.
Der Puls
- A second PHP Windows security patch in five days signals that the first fix did not end the matter.
- An out-of-bounds write in the Brotli decoder opens a path to code execution, raising the stakes for every system that unpacks compressed web content.
- Patches are rippling across PHP, Node.js, Python and Microsoft packages as maintainers race to close the same opening.
- The name has shifted from Node2Shell to HTTP2Shell, widening the alarm to any library or app that handles HTTP traffic.
- Whether the flaw has been exploited in the wild, and how many systems stand exposed, remain open questions.
A flaw in the component that unpacks Brotli-compressed data has forced PHP to ship its second Windows security update in five days, and the repair is spreading outward through the software that depends on that same decoder. The defect, tracked as CVE-2026-111497, lets the decoder write data to memory it was never meant to reach, a weakness that can sometimes be turned into running an attacker's code. As the problem has grown, its name has changed from Node2Shell to HTTP2Shell, a sign that the exposure reaches anything handling web traffic, not just one runtime. What remains unsettled is how far the flaw has traveled into real systems and whether anyone has yet used it.
PHP has released its second Windows security update in five days, and the cause is a flaw in the Brotli decoder, the piece of software that unpacks Brotli-compressed data. The flaw allows code execution, and the PHP release is one visible part of a wider scramble across several software ecosystems.
The vulnerability is tracked as CVE-2026-111497. Researchers describe it as a critical out-of-bounds write: the decoder can be pushed to place data in memory it should never touch, the kind of defect that can be turned into running an attacker's code. Aikido Security ties it specifically to the Node.js Brotli decoder.
Coverage has traveled widely. The Hacker News reported on the Windows PHP update, Wiz published an explainer under the name Broccoli2shell, and Rapid7 and SecurityWeek followed the patching, which SecurityWeek says has reached Microsoft, Node.js and Python packages. The name has also shifted as the picture grew, from Node2Shell to HTTP2Shell, because libraries and applications that handle HTTP are affected too, and HTTP is where compressed content is routinely received and decoded.
Two Windows releases in five days suggest either that the first round did not close the matter or that new findings surfaced quickly. The reporting does not say which. It also leaves open whether the flaw has been exploited in the wild, how many systems are exposed, and what exact conditions trigger code execution.
For organizations running HTTP-facing libraries and applications, the expectation is further patching as the issue moves through different packages. The useful signals to watch are updates from PHP, Node.js, Python and Microsoft, and any word on active exploitation.
PHP has shipped its second Windows security update in five days, and the reason is a flaw in the Brotli decoder, the component that unpacks Brotli-compressed data. The flaw allows code execution. The release is one visible piece of a broader scramble across several software ecosystems.
The vulnerability is tracked as CVE-2026-111497. Security researchers describe it as a critical out-of-bounds write in the Brotli decoder. An out-of-bounds write means the decoder can be made to place data in memory it was never meant to touch, which is the kind of defect that can be turned into running an attacker's code. Aikido Security's write-up frames it specifically as a flaw in the Node.js Brotli decoder.
The headlines gathered around the story show how widely the problem has traveled. The Hacker News reported on the PHP update for Windows. Wiz published an explainer under the name Broccoli2shell, a play on the compression format's name and the shell access an attacker might gain. Rapid7 and SecurityWeek covered the patching that followed, which SecurityWeek says reached Microsoft, Node.js and Python packages.
The naming has also shifted as the picture has grown. Aikido Security reports that what was first called Node2Shell has evolved into HTTP2Shell, because libraries and applications that handle HTTP are affected too. That matters because HTTP traffic is where compressed content is routinely received and decoded, so the exposure is not limited to one runtime.
The pace of the PHP releases is a detail worth noting. Two Windows security updates inside five days suggests the first round did not close the matter, or that new findings emerged quickly as the flaw was examined. The material available does not say which, and it does not spell out what each PHP release changed.
Several things are also not established in the reporting at hand: whether the flaw has been exploited in the wild, how many systems are exposed, or what the exact conditions are for triggering code execution. What is on the record is the CVE identifier, the nature of the defect, and the multi-ecosystem patching it has set off.
For organizations that run HTTP-facing libraries and applications, the practical expectation is more patching as the issue works its way through different packages. Watch for further updates from PHP, Node.js, Python and Microsoft, and for any word on active exploitation.
Bemerkenswerte Zitate
The flaw has evolved from Node2Shell to HTTP2Shell, as libraries and apps using HTTP are affected.— Aikido Security (paraphrased)
Möchten Sie die ganze Geschichte?
Das Original lesen bei Google News ↗
Technology