What Plesk's Windows PHP Brotli Warning Means for You

On 29 October 2026, Plesk warned that the Windows PHP builds it ships are affected by a critical flaw in Brotli, the compression library those builds bundle for PHP. The flaw is CVE-2026-111497. Plesk told administrators to install the PHP packages released on 27 October 2026, which include Brotli 1.2.1. If your business site runs on a Windows server with Plesk, this update belongs on the maintenance list. It is a patching job, and it is a manageable one.

I read notices like this one so you can stay with your customers. When you want a senior engineer for a set block of hours each month, the Able Retainer is $799 a month for eight hours, planned with you. Email greg@ableadmins.com and I will look at your Plesk server with you.

What happened, in plain language

Brotli is a method for squeezing data while it moves between machines. On the Windows PHP builds Plesk ships, a copy of Brotli is bundled for the cURL extension. cURL is the part of PHP that calls another server and reads the reply. Any feature that does that, then unpacks a compressed answer, is the area this notice is about.

Plesk's advisory, updated on 29 October 2026 by Daniel Yordanov, calls the flaw an out-of-bounds write in the Brotli decoder. It affects Brotli 1.0.3 through 1.2.0, and the fixes are Brotli 1.0.10, 1.1.1, and 1.2.1. The Windows packages Plesk told admins to install include Brotli 1.2.1. A crafted compressed stream can corrupt memory in the PHP process. Plesk says that can lead to a crash, memory disclosure, or potentially remote code execution. Memory disclosure means data held in the process could be revealed. Remote code execution means the process might run commands someone else chose. Plesk rates the issue Critical, with a CVSS v4.0 score of 9.2.

On Windows, Plesk says the code is reachable only through the PHP cURL extension when automatic decompression of HTTP responses is enabled. cURL leaves that option off unless an application turns it on. Guzzle, a PHP library for outbound calls, enables it by default. The advisory adds that incoming requests to a website do not trigger it by themselves, and Plesk reports no known active exploitation. The practical reading is steady. Install the updated packages on a normal maintenance schedule.

The Hacker News reported on 26 October 2026 that PHP rebuilt its official Windows packages to include Brotli 1.2.1. The report says Google rates the flaw 9.2 Critical on CVSS 4.0, and Red Hat rates it 8.1 Important on CVSS 3.1. Google fixed the flaw in the Brotli releases disclosed on 21 October. For your server, Plesk's package guidance is the list to follow. The Hacker News piece is there when you want the public timeline beside it.

When you want a senior person to line this up with you, start with the Able Retainer.

What to ask your host

This notice matters when a public site, a shop, or an internal tool runs on Windows under Plesk and uses PHP. Find out who installs PHP and Plesk updates on that machine, and whether the packages from 27 October 2026 are already there.

The Obsidian change log for 28 October 2026 says 18.0.82 Update 1 and 18.0.81 Update 6 update nginx's Brotli to 1.2.1 on Linux and rebuild Windows plesk-engine PHP with Brotli 1.2.1 for this CVE. plesk-engine PHP is the copy built into Plesk itself. On a Windows server, ask for those Plesk updates and the 27 October PHP packages in the same window.

The PHP build numbers and the patched package names are in the two sources below. Ask your host to match the installed handler to that list.

Which Windows PHP handler does the site use, and does the Plesk advisory mark that build as affected?
Please install the PHP packages released on 27 October 2026, the set that includes Brotli 1.2.1.
Please apply the Plesk Obsidian updates from 28 October 2026, and send a note of which update landed.
After the install, please check the handler. Plesk says it is patched when curl_version reports brotli/1.2.1. It is still affected when that report shows brotli/1.2.0 or earlier.
Does the site use Guzzle, or another library that turns on automatic decompression of responses? That is the Windows path the advisory describes.

Keep what they send back. A date, the package that went on, and the brotli line from curl_version are enough to show a later reviewer that the work happened.

I am happy to send that list and read the answers with you. That is a natural use of the Able Retainer.

How Able can help

I do this work on production servers. The Able Retainer gives you eight hours a month of senior time for $799. We plan those hours together, around your releases and your host's maintenance window. For this notice, a clean use of the time is to read Plesk's advisory against your Windows handlers, schedule the 27 October PHP packages, confirm the 28 October Plesk updates, and make sure curl_version reports brotli/1.2.1 when the window closes.

Your developer may already be halfway through the update. I can review the result and leave a short note. If the server usually waits until a page fails, a monthly hour is a calm place to finish this while the packages are current. Email me at greg@ableadmins.com with the server name. I will write back with a plain plan.

The offer page is here: Able Retainer.

Sources

When you want those monthly hours pointed at the server you already have, I am glad to help. The Able Retainer sits here: ableadmins.com/offers/retainer.