The short answer

CVE-2026-111497 is a buffer overflow in Google's Brotli decoder. NVD says versions 1.0.3 through 1.2.0 are affected, and that a crafted Brotli-compressed stream can corrupt decoder memory, disclose memory contents, cause a denial of service, or potentially execute code. NVD rates it CVSS v4.0 9.2 (Critical). The Brotli project released fixed versions 1.0.10, 1.1.1, and 1.2.1 on October 21, 2026. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a federal due date of November 10, 2026. WordPress does not ship Brotli. Updating WordPress, a plugin, or a theme will not patch the library. Ask your host whether the Brotli copy used by the server (often through libcurl and PHP) has been updated to a fixed release, then restart PHP workers.

What the Brotli flaw is

NVD's record for CVE-2026-111497 describes a buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. A remote, unauthenticated attacker who can get a vulnerable process to decode a crafted Brotli-compressed stream may corrupt adjacent decoder state, disclose memory, cause a denial of service, or potentially execute arbitrary code. NVD assigns a CVSS v4.0 score of 9.2 (Critical) and a CVSS v3.1 score of 9.8 (Critical).

CISA's Known Exploited Vulnerabilities catalog describes the same issue as an "unchecked return value" vulnerability and added it on October 27, 2026, with a federal due date of November 10, 2026 under Binding Operational Directive 26-04. CISA's catalog notes point to the official Brotli v1.2.1 release.

Those official GitHub releases are dated October 21, 2026:

Each release note names CVE-2026-111497 and describes an out-of-bounds write that permits remote code execution. NVD tells operators to move any Brotli library or binary in the 1.0.3 through 1.2.0 range to one of those fixed versions.

Coverage of this CVE has also used unofficial names such as HTTP2Shell, Node2Shell, and Brotli2Shell. The name can suggest an HTTP/2 protocol bug. The official records describe a Brotli decoder bug that any program decoding a crafted stream can hit, including software that is not a web server.

What this means for a WordPress site

WordPress does not bundle Brotli. There is no WordPress core, plugin, or theme update that replaces the vulnerable decoder. The copy that matters is the one the operating system or PHP stack provides, usually reached through libcurl when WordPress makes an outbound HTTP request.

Patchstack's October 30, 2026 article, "WordPress doesn't ship Brotli. It's still exposed to CVE-2026-111497," is the clearest public write-up of that path. It reports that a default WordPress install can be induced to fetch an attacker-controlled URL through an unauthenticated pingback call to xmlrpc.php. WordPress retrieves that URL to check the pingback. If the remote server answers with a Brotli-compressed body, libcurl may decode it before WordPress application code sees the response. On a vulnerable Brotli build, that decoding step is the bug.

Patchstack also notes other outbound routes, including plugins or themes that request a visitor-supplied URL and some oEmbed fetches. The important operational point is the same: the inbound WordPress request is not where the bad bytes travel. They arrive in the reply the server itself downloads.

PHP's own news archive is useful here for Windows hosts. On October 26, 2026, the PHP project announced rebuilt Windows packages PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. Those builds include Brotli 1.2.1. PHP says that in its Windows builds the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. That setting is disabled by default in cURL, but applications and HTTP client libraries can turn it on. The -1 suffix marks a Windows package rebuild with updated dependencies; the PHP runtime version number stays the same.

What actually fixes it, and what only reduces reach

The fix is to update Brotli (or the vendor package that provides it) and restart the processes that loaded the old library. For many Linux hosts that means a security update to libbrotli or the equivalent package, then a restart of PHP-FPM or Apache. Patchstack warns that Debian and Ubuntu may backport the fix into an existing 1.1.0 package, so a patched server can still report Brotli 1.1.0. Ask for the package revision or changelog, not only the upstream version string.

Reducing how WordPress reaches the decoder is a temporary control, not the patch. Patchstack's guidance is that turning off XML-RPC with the common xmlrpc_enabled filter does not close pingback, because that filter is aimed at methods that require a login. Unsetting the pingback method, or blocking xmlrpc.php at the web server, can close the easiest reported route. It does not fix Brotli, and it does not cover every outbound fetch.

We are not going to walk through test requests or proof-of-concept details here. If you need to know whether your server is patched, the reliable question is the one your host can answer from package versions and changelogs.

How this differs from PHP2Shell and from WordPress 7.1.4

October 2026 produced three easy-to-confuse problems:

  • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lives in PHP. The fix is a PHP update.
  • This Brotli issue (CVE-2026-111497) lives in a compression library. The fix is a Brotli (or rebuilt PHP Windows) update.
  • CVE-2026-119977 lives in WordPress Core's upgrade process. The fix is WordPress 7.1.4 or the matching backport.

A hosting stack can need all three. Applying only the WordPress security release leaves the runtime and the compression library as they were.

How NTx can help

Most business owners should not be expected to inspect library versions themselves. We can review the host, the PHP runtime, XML-RPC exposure, backups, and the WordPress version as part of WordPress Security or Rescue work, then tell you what needs to change now versus what can wait. If updates have felt unsafe, start at WordPress Updates.

FAQ

What is CVE-2026-111497?

It is a buffer overflow, also described by CISA as an unchecked return value, in Google's Brotli decoder (the file c/dec/decode.c). NVD says versions 1.0.3 through 1.2.0 are affected. A remote unauthenticated attacker who can get a vulnerable process to decode a crafted Brotli stream may corrupt memory, disclose memory, cause a crash, or potentially execute code. The unofficial names HTTP2Shell, Node2Shell, and Brotli2Shell refer to this CVE. It is not a flaw in the HTTP/2 protocol itself.

Does WordPress ship Brotli?

No. There is nothing to update inside WordPress core for this CVE. WordPress can still reach a vulnerable Brotli library when it makes outbound HTTP requests through libcurl. Patchstack describes that path in detail, including unauthenticated XML-RPC pingbacks that cause WordPress to fetch an attacker-controlled URL.

Which Brotli versions are fixed?

NVD tells users to update Brotli libraries between 1.0.3 and 1.2.0 to 1.0.10, 1.1.1, or 1.2.1. The official Google Brotli GitHub releases for those three versions were published on October 21, 2026, and each names CVE-2026-111497. Some Linux distributions backport the fix without changing the upstream version number, so ask your host to check the package changelog, not only the version string.

Will disabling XML-RPC in a plugin fix this?

Not by itself, and not if the toggle only turns off XML-RPC methods that require a login. Patchstack notes that WordPress's xmlrpc_enabled filter gates methods that need an account, while pingback.ping does not need one. Closing pingback can reduce one route. It does not patch Brotli, and other outbound fetches (including some plugin and oEmbed requests) can still reach the decoder.

Is this the same issue as PHP2Shell?

No. PHP2Shell is CVE-2026-109618 and CVE-2026-109619 in PHP itself, fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. CVE-2026-111497 is in Brotli. They happened in the same week, which is why they get confused. PHP's October 26 Windows rebuilds (for example PHP 8.5.12-1) bundled Brotli 1.2.1 to address this separate library issue.

What should I ask my host today?

Ask whether the Brotli library used by libcurl or PHP on the server has been updated for CVE-2026-111497, whether the package changelog includes the October 21, 2026 fix, and whether PHP or the web server was restarted afterward. If you run PHP on Windows, ask whether the host installed the October 26 rebuilt packages that include Brotli 1.2.1.

Sources

  1. NVD, CVE-2026-111497. https://nvd.nist.gov/vuln/detail/CVE-2026-111497
  2. Google Brotli releases 1.0.10, 1.1.1, and 1.2.1, October 21, 2026. https://github.com/google/brotli/releases/tag/v1.2.1
  3. CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog," October 27, 2026. https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  4. CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-111497, date added October 27, 2026, due date November 10, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  5. PHP.net, "Updated PHP Windows builds for Brotli security fix," October 26, 2026. https://www.php.net/archive/2026.php#2026-10-26-1
  6. Patchstack, "WordPress doesn't ship Brotli. It's still exposed to CVE-2026-111497," October 30, 2026. https://patchstack.com/articles/wordpress-doesnt-ship-brotli-its-still-exposed-to-cve-2026-111497/