Microsoft rushed out .NET and PowerShell fixes for the Brotli bug. Rebuild the apps that carry their own copy

We flagged the Brotli decoder bug yesterday in Node.js, Python and Envoy. Since then Microsoft has released out-of-band updates for .NET, Visual Studio and PowerShell, and PHP has rebuilt its Windows packages, because each ships its own copy of the decoder.

No attacks have been reported. The catch is that installing a new runtime does not fix apps that carry their own.

Microsoft patched the Brotli bug in .NET 8, 9 and 10 outside its normal schedule. Self-contained apps and containers stay vulnerable until you rebuild them.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Microsoft shipped out-of-band .NET fixes for the Brotli bug

On October 25 Microsoft released .NET 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3, to fix CVE-2026-111497. Microsoft’s advisory says the bug may let an unauthenticated attacker read or corrupt process memory. Visual Studio 2019, 2022 and 2026 and PowerShell 7.4, 7.5 and 7.6 were also updated, SecurityWeek reports. .NET Framework is not affected.

PHP rebuilt its official Windows packages as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1. The PHP version number does not change, so php -v looks the same before and after.

.NET apps, PowerShell 7 and PHP on Windows carry their own copy

Microsoft says .NET apps are exposed when they decompress Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. The first two are off by default, so the risk sits with apps that turned them on or call the APIs directly.

For PHP on Windows, PHP says the path is the cURL extension decompressing responses. The Hacker News notes that the Guzzle HTTP client turns that on by default, so an app calling outside servers through Guzzle could receive a crafted response.

Update to .NET 8.0.33, 9.0.22 or 10.0.14 and rebuild what bundles it

• Run dotnet --list-runtimes on servers and build agents and install 8.0.33, 9.0.22 or 10.0.14 for each line you use, then restart the apps.
• Rebuild and redeploy self-contained apps, NativeAOT apps and container images; the host runtime update does not reach them.
• Update PowerShell 7 through its usual channel and check the version you actually launch.
• On Windows PHP servers, replace last week’s builds with the -1 packages from windows.php.net and confirm the SHA-256 hash.

Details

• CVE: CVE-2026-111497, out-of-bounds write in Google Brotli 1.0.3 to 1.2.0 (fixed in 1.0.10, 1.1.1, 1.2.1). Google rates it 9.2 (CVSS 4.0); Microsoft rates it 8.1 and “Exploitation More Likely”.
• .NET SDKs with the fix: 8.0.133 and 8.0.427; 9.0.123 and 9.0.320; 10.0.114 and 10.0.403; 11.0.100-rc.3.26522.148.
• Also in the .NET release: a Linux tarball ownership fix, and re-released fixes for two issues the October 13 update did not fully address.
• Still unpatched per a public tracker (SecurityWeek): DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II.

Hunt / verify

• Search code for AddRequestDecompression, AutomaticDecompression with DecompressionMethods.Brotli or All, and BrotliStream to find the .NET apps that reach the decoder.
• In PHP code, search for CURLOPT_ENCODING and Guzzle clients that keep the default decode_content setting.
• Check container base images for the patched .NET tags before the next deploy.

Source: .NET blog: October 2026 out-of-band security updates

Sources

• .NET Blog: .NET October 2026 Out-of-Band Security Updates
• GitHub: Microsoft Security Advisory CVE-2026-111497 (.NET Brotli decoder)
• Microsoft Security Response Center: CVE-2026-111497
• SecurityWeek: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
• PowerShell releases on GitHub
• The Hacker News: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
• PHP for Windows downloads

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].