What does this fix mean for people who run websites or use them, and what should people like the readers do (source)?
In plain words: PHP — a tool used to build websites; Windows — Microsoft's computer operating system; Brotli — a tool for shrinking web data; CVE-2026-111497 — the flaw's public tracking number; AP — The Associated Press news agency; Reuters — an international news agency; BBC — the British Broadcasting Corporation; CBC — the Canadian Broadcasting Corporation; CISA — the United States cybersecurity agency
What to do
Check your Windows PHP package today: the fixed build ends in “-1.”
Visitors have nothing to install; Windows PHP operators should check the build behind the version number.
Who should do what
Website owners: On October 27, check for the “-1” Windows package or ask your host to confirm it.
Developers: On October 27, update affected Windows PHP packages; if delayed, temporarily disable automatic unpacking and test.
What not to do: Do not rely on the PHP version number alone to confirm the fix.
Visitors do not need a new patch. The flaw is in server software, so keep using websites normally. There is no browser or phone setting to change for this fix.
The familiar PHP version number can mislead. On October 27, website owners: if you run official PHP 8.2–8.5 packages on Windows, check the package name for “-1” and install the rebuilt package if it is missing; if a host manages the server, ask it to confirm the rebuild. Restart the affected service after updating.
Automatic unpacking is the path to check. On October 27, developers: if your Windows PHP app fetches replies from other websites and unpacks them automatically, update the package; if you cannot update yet, disable automatic unpacking temporarily and test the change. Check other programs that bundle Brotli separately, since the PHP rebuild does not update them.
This is what most AIs advise. Each AI explains it in its own words below.
What the world's leading AIs think
They agree
10 of 10: website visitors have nothing to install.
They split
Nemotron urges Linux traffic blocking; Kimi says this rebuild is Windows-only.
Not obvious
Guzzle can switch on the risky unpacking that cURL leaves off.
What to watch
If the Windows package name lacks “-1,” the rebuild is still needed.
Read in full
The answers agree that ordinary website visitors have no patch to install. The immediate PHP fix is for operators of official Windows packages, and the PHP team says the rebuilt files contain fixed Brotli 1.2.1.
They also agree the usual PHP version number stays the same. The new Windows package names end in “-1,” so checking only the version shown by PHP can give false confidence.
The risk depends on automatic unpacking of web replies: cURL leaves it off by default, but applications can turn it on. Several answers single out Guzzle because it enables that setting by default.
They differ on what to do beyond this PHP rebuild. Some urge checks of other software that bundles Brotli; others give Linux-specific traffic-blocking advice, which the PHP notice does not establish as a general fix.
They split: Nemotron urges Linux traffic blocking; Kimi says this rebuild is Windows-only. What settles the dispute: The installed Windows package name will show whether the rebuild is in place.
US answers focus on PHP; China answers more often stress the hidden build marker and other runtimes.Only the AIs from one country noticed: AIs from China — several stress that “-1,” not the PHP version, identifies the fixed build.
Who wins, who loses: Windows PHP site owners gain protection; visitors avoid needless patch work.
The final answer, written by an AI
Next to each AI: its place today and its score out of 10, given by other AIs acting as judges. Tap an answer to read it.
1KimiChina8.8The flaw sits off by default; one popular tool turns it on
For you as a visitor, this changes almost nothing: the bug lives in software that runs websites, not in your phone or laptop, and your browser is not the thing being fixed. If you simply use websites, there is no patch for you to install and nothing to click; the whole fix happens on the computers of the people who run each site. The only visible effect might be a site briefly restarting its servers in the coming days.
The people with a real step are those who run a website on a Windows server. The new packages are named 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, and the PHP version itself did not change, so the usual version check shows nothing new; the "-1" in the file name and the hash on the download page are the only way to tell you got the fixed build.
The gap is narrow but real: on a Windows build, a malicious server can strike when the site's code automatically unpacks compressed replies, and the popular Guzzle tool switches that unpacking on by default. No attacks in the wild have been seen so far, and the flaw is not yet on the US government's known-exploited list, but researchers have already run code through it in a lab.
Update today, Tuesday, if you run a website on Windows: grab the "-1" builds from the PHP downloads page and restart your server; if you cannot update yet, turn off automatic unpacking of replies (in Guzzle, set decode_content to false) until you can.
If you only browse the web, do nothing — just expect the sites you use to do their updating quietly. One more wrinkle: PHP 8.2 stops getting security fixes on December 31, 2026, so site owners still on it should plan a move to a newer version regardless of this bug.
Its own forecast: Ubuntu and the standard Red Hat repos ship their Brotli security fix for CVE-2026-111497, catching up with Debian and Alpine — 70% chance by Nov 10, 2026
2DeepSeekChina8.4Critical 9.2, but only Windows PHP needs the patch today
The short answer is that most people who visit websites do not need to do anything: this is a flaw in the official Windows builds of PHP, the software some web servers use, not in the PHP language on other systems.
The risk appears only when a Windows PHP application uses its cURL extension — its tool for fetching web pages — to automatically unpack a compressed response from an attacker-controlled server; cURL leaves that off by default, but some PHP tools, such as Guzzle, turn it on by default.12 Google rates the flaw 9.2 out of 10, but Rapid7 said on October 26 that it knew of no real-world attacks and the flaw was not on the United States' exploited-flaws list.34
The group whose next step changes is people who run websites on Windows PHP, especially on shared hosting or with Guzzle's default settings, because their server may unpack a malicious compressed response.
The fix is already out: PHP rebuilt packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1, the fixed version of the compression tool. Because the PHP version number did not change, `php -v` shows the same number; the '-1' suffix and the SHA-256 hash on the downloads page are how to tell the fixed package apart.
Check, Windows PHP users, your package name today: if it ends in '-1', you have the rebuilt package; if it does not, download the new build from php.net and restart the web server.
If you cannot update immediately, turn off automatic response decompression — but expect compressed responses, including gzip, to stop being unpacked automatically. Website visitors need no step; Linux and macOS PHP users are outside this particular Windows rebuild.
Website visitors do not need to change their browsing habits or stop visiting PHP-powered sites because of this flaw. The risk is to vulnerable software that unpacks specially crafted compressed data, which can cause crashes, expose memory or potentially let attackers run code; the affected PHP Windows builds are vulnerable when applications enable automatic response unpacking.
Sources: php.net and bleepingcomputer.com There is no need for ordinary readers to install PHP or apply a server patch themselves; the website operator or hosting provider handles that work.
Website owners and developers using official PHP Windows packages from versions 8.2 through 8.5 should act promptly, especially if their applications fetch data from other websites and automatically unpack compressed responses. The fixed package builds are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, containing the repaired Brotli 1.2.1 library; the PHP runtime version itself does not change, so checking only `php -v` will not confirm that the fix is installed.
Developers should verify the downloaded package name and its published SHA-256 hash, and check other software that bundles Brotli because a PHP update will not fix those separate copies. Sources: thehackernews.com and php.net
Ask your website host on October 27, 2026, whether it runs affected PHP Windows packages; if it does, request confirmation that the fixed package is installed, and if not, ask whether another application containing Brotli needs updating.
If you manage the server, install the appropriate rebuilt package from the official PHP downloads page and restart affected application processes as needed; if an immediate update is impossible, temporarily disable automatic Brotli response unpacking where feasible and test the change, since this can affect how responses are handled. The latest reports reviewed describe public exploit demonstrations but no confirmed real-world attacks for this flaw, so prioritize patching without assuming that a particular website has been compromised.
Its own forecast: At least one major PHP hosting provider will publish a customer-facing notice specifically naming CVE-2026-111497 and confirming that its affected Windows PHP packages have been updated. — 60% chance by Nov 10, 2026
4MiMoChina8.1A popular PHP helper switches the risky step on by itself
The fix protects websites, not visitors — and it hides in plain sight. The flaw sits in Brotli, a tool that shrinks web data to speed up transfers; on a Windows website, a fake server can use it to run its own code when the site's page-fetching part (called cURL) automatically unpacks what it downloads (thehackernews.com, php.net).
The homework lands on people who run websites and on hosting companies. PHP, the software that runs many websites, fixed this on October 26 with rebuilt Windows packages — its second emergency rebuild in five days — yet the version number stayed the same, so the usual check shows nothing; only the '-1' in the file name and the code fingerprint on the downloads page prove the fix is in (thehackernews.com, php.net).
The same broken part also rides inside Node.js, Bun, Python tools and Microsoft.NET, so those owners have their own updates to install (rapid7.com, isc.sans.edu).
Check today, people who run a website on Windows: if your site fetches data from other sites — payment checks, feeds, or the common Guzzle helper, which switches this risky step on by itself — install the build marked '-1' before tonight, October 27, and until then turn off automatic unpacking (thehackernews.com); if your site never talks to other servers, wait and patch on your usual update day.
Its own forecast: The popular PHP helper Guzzle changes its default or publishes a security note about this Brotli flaw — 30% chance by Nov 26, 2026
5MetaUSA7.9Two Windows PHP fixes in five days — this one lives in auto-unpack
For most people this is not a crash on your phone today, but a hidden way for a bad server to feed poisoned shrunken data to a site you use.
The issue is an out-of-bounds write vulnerability in Brotli decompression that can let an attacker corrupt memory and potentially run code when it is reached through the cURL extension when automatic HTTP response decompression is enabled, a switch that is disabled by default in cURL, but applications and HTTP client libraries can enable it.
For shop owners and others who run PHP sites on Windows, the change is bigger because you have to swap the program itself. On October 26 the PHP team shipped four rebuilt Windows packages, PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 that now include Brotli 1.2.1 to fix CVE-2026-111497, just five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws.
Google rates the flaw 9.2 out of 10, or Critical, and as of October 26 the vulnerability is not in CISA's Known Exploited Vulnerabilities catalog.
Check your server today, October 27, site owners: if you run PHP 8.2 through 8.5 on Windows, download the -1 builds from the PHP downloads page now and restart; if not, you can wait for your host to do it. The rebuilds use the same PHP source so the version you see stays the same, and you tell them apart by the -1 in the file name. Until patched, turn off automatic unpacking for shrunken web replies in any code that fetches other sites.
Its own forecast: A major security vendor publicly confirms an exploitation attempt against Windows PHP using CVE-2026-111497 — 45% chance by Nov 15, 2026
6Z.aiChina7.9No attacker has used it yet, but demo exploits are already public
If you just visit websites, this changes nothing for you today. The flaw sits in Brotli — a free Google-made tool that squeezes web data so pages load faster — inside server software, not your phone or browser, and no criminals are known to have used it yet; demo attack code is public, though.
The people whose next step changed are anyone running a website on a Windows server with PHP. On October 26 PHP repackaged its Windows files (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) with the fixed squeeze tool, version 1.2.1 — the PHP code itself never changed.
The hole can only be reached through the PHP part that fetches other web pages (cURL) when a site turns on automatic unpacking of squeezed replies, which is off by default; the same Brotli bug already forced emergency fixes from Node.js, Microsoft's.NET and Python tools last week.
Check, today, October 27, what runs your website: if it's PHP on a Windows server, have your host install the new packages and restart this week; if it's Linux or your host manages updates for you, just confirm last week's PHP fix (8.5.12, 8.4.27, 8.3.36 or 8.2.35) is in place. If you also run Node.js apps, update to 22.23.4, 24.22.1 or 26.12.1 right away. If you're just a visitor, keep your browser updating automatically and carry on.
Its own forecast: A vendor, CISA, or major security firm publicly documents attempted or confirmed exploitation of the Brotli flaw CVE-2026-111497 on real systems, beyond the published demo code — 20% chance by Nov 20, 2026
7Nemotron + MercuryUSA7.9Guzzle turns an off-by-default Brotli bug into a reachable one for PHP on Windows
For ordinary visitors, the message is simple: keep automatic updates on and do nothing else today; this is a server-side bug, and no attack has been confirmed in the wild as of October 26.
It changes things for people running websites: if your site is PHP on Windows, install the rebuilt packages right away — PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1 — and restart the web-server process. If you're on Linux, check for a Brotli update, and until one exists, strip or reject Brotli-encoded traffic from untrusted clients.
The same flaw goes well beyond PHP: update Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4 or newer, and apply Microsoft's emergency.NET updates (8.0.33, 9.0.22, 10.0.14) plus PowerShell and Visual Studio patches.
Today, October 27, site owners: if you run PHP on Windows, install the rebuilt packages and restart the process; if you run Linux, check for a Brotli update and until one exists, strip or reject Brotli-encoded traffic from untrusted clients.
Its own forecast: CISA adds CVE-2026-111497 to its Known Exploited Vulnerabilities catalog — 40% chance by Nov 26, 2026
8StepFunChina7.8This bug attacks the machine that asks, not the one that answers
If you only read and shop on websites, this fix changes nothing for you — the broken code sits on web servers, not on your phone or laptop. What makes it odd is the direction of the attack. Normally a stranger on the internet attacks your website; here it runs the other way — a site your own server goes to for data can be the one that attacks it.
It matters to anyone running PHP on Windows, because those official builds carry the download tool called cURL, which unpacks squeezed-down web answers by itself — and that unpacking is where the bug sits.
But it is bigger than PHP: the same broken unpacking code travels inside Node.js, Microsoft's.NET, the curl download tool and Git, and Microsoft pushed emergency fixes out on October 26. No real attacks have been seen so far, though ready-made test code was public a day after the bug got its name.
Check your server today, October 27: if you run PHP on Windows, download the new build from php.net and restart the web service; if a hosting company runs PHP for you, ask them to do it. If you build things that fetch data from other sites, either update the download library or stop asking for squeezed answers, and do it before November 3.
Its own forecast: A security company publishes proof that attackers are using this Brotli bug in real attacks — 35% chance by Nov 20, 2026
9GrokUSA7.5File names end in -1 but the PHP version stays the same
Most people who just visit websites face almost no extra risk from this. Nearly all PHP sites run on Linux, where the problem does not hit the same way, and no real-world attacks using the flaw have been reported yet. The automatic unpacking of web responses that can trigger it stays turned off unless a site owner or a common tool switches it on.
People who run their own websites or small business tools on Windows servers face the real change. If their PHP setup talks to other servers and unpacks the replies automatically, an attacker could send a crafted reply and run code on the server. Popular tools that many developers use do turn that feature on by default.
Site owners, check today on October 27 whether your server runs Windows and PHP 8.2 through 8.5. If it does and any of your code or libraries unpacks web replies automatically, download the new packages that end in -1 from the official page and restart; if your site runs on Linux or you never enable that unpacking, do nothing more.
Its own forecast: No public report of active exploitation of the Brotli flaw against any PHP Windows installation appears — 75% chance by Nov 10, 2026
10GeminiUSA6.2PHP updates Windows builds again to fix high-risk Brotli data decompression flaw
For ordinary web visitors, this security fix means the sites and web apps they interact with are plugging a critical memory flaw that could otherwise let attackers run malicious code on backend servers. The bug relies on how applications automatically unpack compressed data using Google's Brotli tool, putting web servers at risk whenever they fetch or process external web content.
For website operators, server administrators, and IT managers running PHP on Windows environments, this update represents an urgent technical maintenance requirement. Because the underlying issue affects many software runtimes beyond PHP, including Node.js and Python tools, developers using these tools in their backend stacks face a similar need to apply patched versions.
Upgrade your Windows PHP installations to the patched build releases (such as PHP 8.5.12-1 or 8.4.27-1) on October 27, 2026, if you host PHP apps on Windows; if you do not run PHP on Windows, verify whether your other web services use bundled Brotli libraries and update them accordingly.
