Zarro Technology · Security briefing

Today’s verified changes affect Windows-hosted PHP services and business Macs. The PHP item concerns newly rebuilt packages for an existing vulnerability; Apple’s update addresses separate platform weaknesses. These updates warrant checking deployed software, rather than assuming that an earlier runtime update covered every bundled component.

1. PHP Windows: rebuilt packages fix bundled Brotli (Critical)

CVE-2026-111497 (9.2)

Impact

On 26 October, PHP announced Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, incorporating Brotli 1.2.1. The vulnerable decompressor can be reached through PHP’s cURL extension when automatic response decompression is enabled. It is disabled by default, but application libraries can enable it.

Checks and remediation

  • Check Windows PHP package provenance and bundled dependencies, including application-managed installations.
  • Replace affected packages with the corresponding -1 rebuild through the supported deployment route, and restart affected services as required.
  • Verify the deployed package, not just the interpreter’s version string: PHP explicitly says the runtime version remains unchanged in these rebuilds.

Checks and IoCs

Review unexpected PHP/cURL process crashes around compressed HTTP responses as investigation leads. They are not definitive compromise indicators. The cited notice supplies no campaign-specific IPs or hashes and does not establish active exploitation of this PHP Windows exposure.

Sources: PHP: updated Windows builds, 26 October · Brotli CVE record and score

2. macOS: sandbox and Gatekeeper fixes (High)

CVE-2026-112690, CVE-2026-112568

Impact

Apple released macOS Golden Gate 27.2 on 26 October. Its security notice includes a remote WebContent sandbox escape in the App Store component and a Gatekeeper bypass triggered by a crafted file. The CVEs above identify these examples; the update contains additional fixes. No verified numeric scores are included here. The High label is an editorial assessment of the described impact, not an Apple CVSS rating.

Checks and remediation

Check managed Macs’ installed OS versions and update status. This read-only command reports the local macOS version:

sw_vers -productVersion

Deploy 27.2 to supported Golden Gate Macs using the approved software-update or device-management process. Apple also lists updates for other supported macOS branches; match each device to its own release and advisory rather than assuming an older branch has identical fixes.

Checks and IoCs

Investigate unexpected application behaviour or suspicious downloaded files using existing endpoint telemetry. The cited entries do not supply campaign IoCs or state that these two flaws are being actively exploited; absence of alerts is not proof that a device is uncompromised.

Sources: Apple: macOS 27.2 security content · Apple security release and supported-branch list

Zarro Technology

  Print