Microsoft scores the Brotli flaw 8.1 where Google's record says 9.2, and PHP's Windows fix keeps its version number

One bug, one Microsoft score, two severity words

Microsoft's security update guide data for CVE-2026-111497, read on 26 October 2026, lists 19 product rows. All 19 carry the same CVSS 3.1 base score, 8.1, and the same vector. Sixteen rows say Critical and three, the PowerShell 7 rows, say Important (derived by counting the rows). Google, the assigning authority in the CVE record, scored the same flaw 9.2 on CVSS 4.0, and Node.js calls it High. That is three different severity words, Critical, High and Important, from three publishers for one bug in one decoder, and no two of the scores can be set side by side: the versions of CVSS differ and each publisher scored its own product.

What that does not establish is exploitation. Microsoft's data marks exploited as No, and its exploitability assessment reads Exploitation More Likely, which is a forecast and not an observation. The CISA known exploited vulnerabilities file fetched at 20:33 UTC carried catalogue version 2026.10.23 (released 23 October at 19:30 UTC, 1,756 entries) and does not list the CVE. The CISA entry inside the CVE record gives Exploitation as none, dated 23 October. All three are time stamped, so none is a permanent answer.

This briefing adds to the earlier briefing on this flaw, which covers Node.js, Bun and the Python packages, and does not repeat it. New on 26 October: BleepingComputer reported Microsoft's out of band .NET updates at 15:38 UTC and the nickname HTTP2Shell at 16:27 UTC; The Register followed at 17:58 UTC; SecurityWeek ran its roundup at 10:21 UTC; and The Hacker News is reported to have run a headline about a second PHP Windows update in five days, but its server answered this site's request with an HTTP 403 block, so that page was skipped and nothing here rests on it. The primary pages were read from 20:30 to 20:50 GMT on Monday 26 October 2026: Microsoft's advisory data and .NET blog, the .NET and PowerShell advisories on GitHub, the PHP project's news archive and downloads page, the CVE record, the NVD record, the Brotli release page, the Node.js post and OpenAI's Patch the Planet advisory. Microsoft scores and ships its own product, OpenAI's Codex Security is credited with the finding and OpenAI publishes that advisory, and Imperva, Aikido, JFrog and Wiz each sell security products, so each claim below carries its source.

What happened between the Brotli release and the Microsoft and PHP fixes

The last row matters for anyone who counted PHP's Windows builds as patched on 21 October. Those builds shipped about 19 hours before Brotli 1.2.1 existed, and PHP's own news post says the later builds are the ones that include it. A headline of a second PHP Windows update in five days would fit the 5 days 11 hours 32 minutes between PHP's two posts, but the two posts are about different bugs: the first fixed two PHP flaws, the second fixes Brotli.

Zoom

What Microsoft shipped, and what its own labels say

Microsoft's blog post of 25 October at 18:45 UTC says it is releasing out of band security updates for .NET 8, .NET 9 and .NET 10, along with .NET 11 Release Candidate 3, and recommends updating as soon as possible. The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14. Microsoft says .NET Framework is not affected. The same release also fixes CVE-2026-114148, a Linux tarball ownership flaw, and re issues two advisories, CVE-2026-70197 and CVE-2026-102870, because the 13 October release did not fully address them. That is a reason to take the update even where the Brotli path is switched off.

Microsoft's advisory describes an out of bounds write in .NET that lets an unauthenticated attacker elevate privileges over a network, and files it as Elevation of Privilege. Its blog says the flaw may allow an attacker to read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege. The PowerShell advisory on GitHub is titled a Remote Code Execution Vulnerability, while its own summary says elevate privileges over a network. Node.js says remote code execution. Three category names for one decoder flaw, and a defender cannot tell from the label which outcome to plan for.

Microsoft's scoring has a condition built in. The vector is CVSS 3.1 with attack complexity High and exploit code maturity Unproven, giving a base of 8.1 and a temporal score of 7.1, scored by Microsoft. The advisory says Brotli decompression is not enabled by default in an out of the box .NET or ASP.NET Core install, and an application is not exposed merely because an affected package is installed. Exposure needs one of three paths, shown below: ASP.NET Core request decompression with br, HttpClient automatic response decompression with Brotli, or direct use of BrotliStream or BrotliDecoder. The advisory table lists 225 affected package rows across .NET 8, 9, 10 and 11 (derived by counting: 52, 51, 56 and 66), including NativeAOT and Mono runtime packs, and says updating the machine's shared runtime does not replace a decoder already linked into a NativeAOT executable.

Zoom

PHP on Windows: a rebuild with the same version number

The PHP project's news post of 26 October at 11:57 UTC announces updated Windows builds: PHP 8.5.12 with a 1 rebuild suffix, 8.4.27, 8.3.36 and 8.2.35, written 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1. PHP says the vulnerable decoder can be reached in Windows builds through the cURL extension when automatic HTTP response decompression is enabled, that this is disabled by default in cURL, and that applications and HTTP client libraries can enable it.

The post then says the suffix identifies a Windows package rebuild with updated dependencies, that the builds use the same PHP source releases, and that the PHP runtime versions remain unchanged. That sentence has a consequence the post does not draw out. Asking a Windows PHP what version it is will return the same number before and after this fix. The only marker the project prints is the package label and the build stamp: the downloads page I read stamps the four sets at 13:05 to 13:07 UTC on 26 October and prints a SHA256 for each file. That is this site's reading, not a statement by PHP, and the post prints no command that reports the bundled Brotli version.

Three limits on what the PHP pages establish. They cover Windows builds of 8.5, 8.4, 8.3 and 8.2 only; whether older Windows builds also bundle Brotli is not stated, and PHP's 21 October advisory says PHP 8.1 and older no longer receive project updates. They say nothing about Linux packages, which take their cURL and Brotli from distributions. They give no CVSS score, impact class or exploit for PHP, because the news post is not an advisory for this flaw. The same news page carries a separate post for CVE-2026-115560, a session upload progress setting, and the 21 October advisory for two other critical PHP flaws; neither concerns Brotli, and php.net's Brotli post does not use the PHP2Shell nickname that headlines attach to the 21 October flaws, so the two stories should not be merged.

HTTP2Shell, Node2Shell and Broccoli2Shell: who named what, and what each name leaves out

Who gains from a name is worth a sentence. Imperva sells a web application firewall and says it added rules, Aikido sells patched container images and offers them in the same post, JFrog sells a supply chain scanner and publishes a detection tool beside it, and Wiz sells cloud security and quotes its own telemetry, 91 per cent of cloud environments with resources vulnerable and 82 per cent with publicly exposed Node.js instances, which counts exposed components and not attacks. OpenAI, whose Codex Security is credited with the finding, runs the Patch the Planet advisory that gives the clearest rule on the point: reject Brotli before any proxy, middleware or body parser decompresses it.

Zoom

What the record states and what it does not

One more caution on reading the table. Everything the vendors print is a statement about their own product at a point in time. Microsoft's advisory was at version 1.0 when read, NVD was Awaiting Analysis, and the CVE record itself was updated at 18:10 UTC on 26 October, which is after every news report I read. A claim that is true at 20:30 can be false by morning.

Technical details

These are the artifacts the vendors and researchers print, copied as printed and attributed in each caption. The primaries publish no hashes of malicious files, domains or network indicators, and Imperva says it has not released its exploit. JFrog prints a crafted byte string that triggers a crash in FFmpeg through JPEG XL; this briefing does not reproduce it, because a defender does not need it and it would make an attack easier. No exploit code is included.

Check what is installed on a machine. Microsoft prints this command and says it covers framework dependent deployments only: self contained applications and containers carry their own runtime and must be checked separately.

dotnet --list-runtimes

Microsoft prints the fixed versions on its GitHub advisory in these sentences (the download link at the end of each is left out here). Compare them with the output above.

If you're using .NET 8.0, you should download and install .NET 8.0.33 Runtime or .NET 8.0.133 or 8.0.427 SDK
If you're using .NET 9.0, you should download and install .NET 9.0.22 Runtime or .NET 9.0.123 or 9.0.320 SDK
If you're using .NET 10.0, you should download and install .NET 10.0.14 Runtime or .NET 10.0.114 or 10.0.403 SDK
If you're using .NET 11.0, you should download and install .NET 11.0.0-rc.3.26522.148 Runtime or .NET 11.0.100-rc.3.26522.148 SDK

Where an application already decompresses Brotli and cannot be updated yet, Microsoft prints two configuration changes. Microsoft's own warning applies: do not add either call if the application does not already decompress, because enabling automatic decompression can introduce denial of service risks even when Brotli is excluded. Edit only the existing configuration and test it.

builder.Services.AddRequestDecompression(options =>
{
    options.DecompressionProviders.Remove("br");
});

var handler = new HttpClientHandler
{
    AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate
};
var httpClient = new HttpClient(handler);

PowerShell 7: Microsoft's advisory gives this check and the affected ranges, and says the issue affects you if you use Invoke-WebRequest or Invoke-RestMethod against websites without SSL or that you do not control.

pwsh -v

PowerShell 7 Version   Affected version   Patched Version
7.6                    <7.6.9             7.6.9
7.5                    <7.5.13            7.5.13
7.4                    <7.4.22            7.4.22

PHP on Windows: the downloads page prints the rebuilt package labels, the build stamp and a SHA256 for each file. The first set is shown. Compare the hash of the zip you hold with the page; the runtime's own version string will not tell you.

PHP 8.5 (8.5.12-1)
VS17 x64 Non Thread Safe 2026-Oct-26 13:05:05 UTC
Zip 34.63MB
2a36a2edcb7a5b9252f638fd5e4cf84d7f6e066092654220dc0b63e5cf4e9723

In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.

The -1 suffix identifies a Windows package rebuild with updated dependencies. These builds use the same PHP source releases, and the PHP runtime versions remain unchanged.

The two scores as the records print them. Google is the CNA in the CVE record and NVD; Microsoft scored its own product. The record also lists CWE-787 (out of bounds write) and CWE-252 (unchecked return value).

Google (CVE record, CVSS 4.0, base 9.2 Critical):
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Microsoft (CVSS 3.1, base 8.1, temporal 7.1):
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The Broccoli2Shell tracker site, whose operator is not named, prints commands for finding other copies. They are a secondary source and unverified by this site, but they are plain read only checks.

node --version
# affected if below 22.23.4, 24.22.1 or 26.12.1, or on an end-of-life line
node -p "process.versions.brotli"

pip show Brotli brotlicffi

sudo grep -l brotlidec /proc/*/maps 2>/dev/null

On detection, Imperva says unexpected process exits during decompression and decoder errors may help prioritise an investigation, and that neither is a reliable sign of exploitation by itself; correlate them with the deployed runtime, application logs and the source of the compressed data. JFrog says it has released an open source scanner for Brotli decoding paths. This site has not run or reviewed it.

What to do, in the order worth doing it

The question your patch report has to answer

When the report says the .NET runtime is updated, can it also say which self contained, container and NativeAOT builds still carry their own copy of the decoder, which applications switched Brotli on, and whether any PHP on Windows is a rebuild whose version number looks exactly like the old one?

Key facts