Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Bitpalast]

Regarding the Brotli desaster I want to make you aware that updating the libraries won't be enough (e.g. when your operating system updates them). You'll also need to restart the services that depend on them, and this also applies to the service if it only links dynamically to the Brotli library. The reason is that services load the library when they start. If the library is updated, it does not change in the memory of the service, so the service still uses the previous version that can be attacked.

What you should restart is definitely all php-fpm services. What you normally do not need to restart are Nginx and Apache, as both route incoming traffic through to the endpoint without decompressing it. If you are using Node, Ruby, Bun etc., restarts are required.

On the command line, I'd suggest to run python3 -c "import pkg_resources; [print(f'{d.project_name}: {d.version}') for d in pkg_resources.working_set if d.project_name.lower() in ['brotli', 'brotlicffi']]" once, just to make sure that your Python does not use the Brotli package by default. No output = no problem.

Finally, another piece of unasked advice: Your distributor might backport the updated Brotli files, so that they still carry version numbers that appear to be affected by the flaw. However, you can find out what the real update status is by querying the package manager, for example for Alma/RHEL it would be
rpm -q --changelog brotli | grep -i "CVE-2026-111497" or to see the first few lines rpm -q --changelog brotli | head -n 5.

 

[pleskuser67553]

Regarding the Brotli desaster I want to make you aware that updating the libraries won't be enough (e.g. when your operating system updates them). You'll also need to restart the services that depend on them, and this also applies to the service if it only links dynamically to the Brotli library. The reason is that services load the library when they start. If the library is updated, it does not change in the memory of the service, so the service still uses the previous version that can be attacked.

What you should restart is definitely all php-fpm services. What you normally do not need to restart are Nginx and Apache, as both route incoming traffic through to the endpoint without decompressing it. If you are using Node, Ruby, Bun etc., restarts are required.

On the command line, I'd suggest to run python3 -c "import pkg_resources; [print(f'{d.project_name}: {d.version}') for d in pkg_resources.working_set if d.project_name.lower() in ['brotli', 'brotlicffi']]" once, just to make sure that your Python does not use the Brotli package by default. No output = no problem.

Finally, another piece of unasked advice: Your distributor might backport the updated Brotli files, so that they still carry version numbers that appear to be affected by the flaw. However, you can find out what the real update status is by querying the package manager, for example for Alma/RHEL it would be
rpm -q --changelog brotli | grep -i "CVE-2026-111497" or to see the first few lines rpm -q --changelog brotli | head -n 5.

I started a separate thread for the Brotli CVE Issue - Brotli CVE-2026-111497