The Brotli flaw (CVE-2026-111497) on WordPress: check your server and close the gap

What happened

• The bug: CVE-2026-111497, rated 9.2 out of 10, is a memory flaw in the part of Google’s Brotli library that unpacks compressed data. A crafted compressed response can crash the program reading it, leak memory or, in some programs, let an attacker run code.
• Affected: Brotli 1.0.3 to 1.2.0. The fixes, 1.0.10, 1.1.1 and 1.2.1, came out on 21 October 2026, and Linux distributions have since released patched packages.
• The nickname: “Node2Shell”, because the first public code-execution exploits targeted Node.js.
• Attacks: the threat-monitoring firm ELLIO reported exploit traffic in the wild, and the US cyber agency CISA added it to its list of exploited vulnerabilities on 27 October 2026, with a 10 November deadline for US government systems.

Why WordPress is exposed, even though it doesn’t ship Brotli

WordPress fetches outside addresses all the time, and it does it through curl, the download tool built into PHP. WordPress tells curl to accept and unpack any compression the other server sends, Brotli included, and there is no setting to turn that off. The unpacking happens inside curl, before WordPress sees anything. So if WordPress fetches an address from an attacker’s server, that server can answer with a booby-trapped Brotli response.

The routes on a typical site:

• Pingbacks through xmlrpc.php. Anyone can send one, no login needed, and WordPress then fetches the address they give. On a default install this is open. It’s the route the public test uses.
• Link previews (oEmbed) when someone pastes a link into a post. This needs a Contributor account or higher.
• Feeds your site reads, for example in an RSS widget.
• Plugins that fetch an address a visitor gives them: link previews, image or URL importers, webhook checks, avatar proxies.

A firewall plugin can’t see this attack. The request to your site looks normal, and the harmful part arrives in the answer from the attacker’s server, which curl unpacks before any plugin runs.

How serious is it for WordPress?

• Crashing the site: shown. A public test published on 27 October uses a pingback to kill a server worker or pin it at 100% CPU, with a payload under 100 bytes. Repeated, that can take a site offline.
• Taking over the site: not shown. The public code-execution exploits target Node.js and Bun, not PHP. Patchstack found no public chain against PHP as of 30 October.
• Hacked WordPress sites: none confirmed publicly as of 1 November 2026.

So for now it’s mainly a way to knock sites offline. Patch it this week, but it doesn’t mean your site has been hacked.

Check your server

On shared or managed hosting, you can’t check this yourself. Ask support: “Is the October 2026 Brotli security update (CVE-2026-111497) installed, and has PHP been restarted since?”

With SSH access, check the installed package:

# Debian / Ubuntu
dpkg -l 'libbrotli*'

# AlmaLinux / Rocky / RHEL / CloudLinux
rpm -q brotli

Compare the version with the fixed one for your system:

Running WordPress in Docker? The official wordpress image still installed the vulnerable package on 30 October. Upgrade libbrotli1 in your own image until the base image is rebuilt.

On Windows (IIS, XAMPP, WAMP), PHP includes its own Brotli, so the fix is PHP’s rebuilt 26 October package. The free Moatline Malware Scanner checks this on Windows servers and warns you when the old build is still in place.

Fix it

1. Install the update.

   # Debian / Ubuntu
   apt-get update && apt-get install --only-upgrade libbrotli1
   
   # AlmaLinux / Rocky / RHEL
   dnf upgrade --refresh brotli

2. Restart PHP and the web server, or reboot. Running PHP-FPM workers keep the old library in memory until they restart. On Debian and Ubuntu, needrestart lists the services still using it.
3. Check the package version again against the table.

If you look after several client sites on different hosts, send each host the support question above. Sites on the same server share one Brotli package, so a single update covers them all.

Until the update is in

None of these fix the bug, but they close the doors a WordPress site leaves open:

1. Turn off pingbacks. This closes the route that needs no login. In the free Moatline Malware Scanner: Protect → Spam & bots → XML-RPC → Block. If you use Jetpack, choose Jetpack-safe, which refuses everything except Jetpack’s own signed requests. Without Moatline, block xmlrpc.php at the server:

   # Apache 2.4 (.htaccess)
   <Files xmlrpc.php>
     Require all denied
   </Files>
   
   # Nginx
   location = /xmlrpc.php { deny all; }

   The common xmlrpc_enabled filter doesn’t stop pingbacks, so don’t rely on it alone.
2. Optional: stop WordPress unpacking compressed downloads. This covers pingbacks, link previews, feeds and plugins at once. Save it as wp-content/mu-plugins/no-brotli.php and delete it once the server is patched:

   <?php
   // Temporary: stop curl unpacking compressed responses (CVE-2026-111497).
   add_action( 'http_api_curl', function ( $handle ) {
       curl_setopt( $handle, CURLOPT_ENCODING, 'identity' );
       curl_setopt( $handle, CURLOPT_HTTP_CONTENT_DECODING, 0 );
   } );

   Downloads get a little bigger and slower. Test plugin and theme updates after adding it.
3. Review plugins that fetch links for visitors, such as link preview or importer plugins, and switch off any you don’t need.

Signs of an attack

• Crashes in the error log: Apache Segmentation fault (11), or PHP-FPM children “exited on signal 11”, sometimes mentioning libbrotlidec.
• PHP workers stuck at 100% CPU, or pages timing out with no clear cause.
• Many POST /xmlrpc.php requests in your access log, especially pingbacks pointing at unfamiliar or brand-new domains.

A crash isn’t a break-in. But if your host sees the web server user starting a shell or curl, treat the site as compromised: scan it, check for admins you didn’t create and follow the cleanup steps.

Related: PHP2Shell, the PHP flaw from the same week and WordPress 7.1.4.

Sources: Patchstack, Panelica (fixed packages by system), Sophos and Help Net Security.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

More guides

• WordPress 7.1.4: the update-window vulnerability and what to do
• WordPress files deleted: how we rebuilt a site from its database
• TRUST#GRAFT: a fake Cloudflare check that installs a backdoor through your own browser
• The WordPress.org notice about Essential Plugin: how to clean what the update left behind
• PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed versions and what to do now
• Bricksforge vulnerability exploited: how to check your site and clean it

All guides →