Skip to content
Tuesday, 3 November 2026Threat Detection & DefenceCyber SafetyIdentity & AccessDevices & IoTCloud Security
Wire
01n0n Ransomware Lists ONE, Pelindo's ILCS and NCT Kandla Among 38 Maritime Firms; the Gang Uses an AI Coding Agent02Brotli Flaw CVE-2026-111497 Reaches WordPress Through Pingbacks: RCE Shown on One Docker Image, Fix Is the Server Library03Binance Proof of Reserves for 31 October Is Now Verifiable; Thai SEC Watches Exposure as Indodax Says It Closed a Security Gap04Mumbai Police Arrest Six Over ₹72 Crore Cyber Fraud Trail Linked to 255 Complaints and Mule Accounts
NewsThreat Detection & Defence

Brotli Flaw CVE-2026-111497 Reaches WordPress Through Pingbacks: RCE Shown on One Docker Image, Fix Is the Server Library

An unauthenticated WordPress pingback can make the server decode attacker-supplied Brotli data, reaching CVE-2026-111497. Code execution is shown on one Docker image; the fix is a patched libbrotli, not a WordPress update.

Cybersecurity ASEAN editors · 2 min read
Brotli Flaw CVE-2026-111497 Reaches WordPress Through Pingbacks: RCE Shown on One Docker Image, Fix Is the Server Library

The Brotli decoder flaw CVE-2026-111497, which CISA added to its Known Exploited Vulnerabilities catalogue on 27 October, can be reached on WordPress sites by anyone on the internet, through the pingback feature. Researchers have turned it into code execution on one specific WordPress Docker image. Updating WordPress doesn't help: the vulnerable code is the server's Brotli library.

Fixed versions for Node.js, .NET and PAN-OS are in our report from when the flaw was first exploited.

How a pingback gets to the decoder

An unauthenticated pingback request to xmlrpc.php makes WordPress fetch the URL it was given. If that server answers with Brotli-compressed content, "libcurl invokes the native Brotli decoder", security firm Fortbridge explains in its 2 November write-up, and a malformed stream corrupts memory inside PHP.

Patchstack says a stock install has XML-RPC on, pings open and at least one pingable post. Both Patchstack and Wordfence note that the common setting for disabling XML-RPC authentication doesn't stop pingbacks, which need no login.

How reliable it is

A public proof-of-concept runs commands on one pinned image: WordPress 7.1.3 on PHP 8.3.36 with Debian's libbrotli1 1.1.0-2+b7, which was the official wordpress:latest image when it was published. Its author makes no claim about other images. Wordfence reproduced it in a lab, but "the same payload did not execute against PHP 8.3.35", and calls the exploit not universal.

Denial of service is the other risk. A public lab shows a worker killed with SIGSEGV, and another pinned at full CPU by an 86-byte payload. Wordfence found no public report of a successful compromise through WordPress, while citing other firms' reports of continuing attempts against Brotli in general.

What to do

  • Debian 13: libbrotli1 1.1.0-2+deb13u1 (DSA-6582-1). Debian 12: 1.0.9-2+deb12u1. Check the full package revision: the build in the public exploit, 1.1.0-2+b7, is vulnerable.
  • Ubuntu: USN-8956-1 ships 1.1.0-2ubuntu0.1 for 24.04 and 1.0.9-2ubuntu0.1 for 22.04.
  • Official WordPress Docker image: the current latest (7.1.4-apache) carries libbrotli1 1.1.0-2+deb13u1. Pull it and recreate the container; Wordfence warns that restarting an existing container keeps the old library.
  • Other builds: Brotli is fixed upstream in 1.0.10, 1.1.1 and 1.2.1. Restart PHP-FPM or Apache after updating so no process keeps the old library loaded.
  • Until you can patch: Patchstack suggests removing pingback.ping with the xmlrpc_methods filter, blocking xmlrpc.php at the web server, or forcing curl to request uncompressed responses. It says none of these replaces updating the library.

More news