Most people who run a small business website have never heard of Brotli. That is completely fine -- it is infrastructure software, the kind that works silently in the background making your website load a bit faster for visitors. But a recently disclosed security flaw in Brotli has changed things. This one is classified as a remote code execution vulnerability, which is the category of flaw that gets security teams moving quickly. Here is what that means for you, and what you need to do about it.
What Is Brotli and Why Is It on So Many Systems?
Brotli is a data compression tool, originally developed by Google. When a visitor loads your website, the files that make up that page -- the code, the styling, the layout instructions -- get compressed before they travel from the server to the browser. Brotli is one of the tools commonly used to do that compression. It is built into or available as an add-on for many web server setups, and it is also supported by PHP, the programming language that powers a large share of small business websites, e-commerce stores, and content management systems including WordPress.
Because Brotli is used so widely across web infrastructure, a vulnerability in it does not sit in a quiet corner of the internet. It sits in the plumbing that a significant portion of business websites depend on every day.
What the Vulnerability Actually Means
The flaw is classified as a remote code execution vulnerability. In practical terms, that means an attacker who exploited it could potentially run their own code on the server hosting your website or application -- without needing to be physically present or even to log in. They would use specially crafted compressed data to trigger the flaw during decompression.
Remote code execution vulnerabilities are taken seriously because they hand an attacker a foothold. From that foothold, they can do a range of things: access files, install malware, set up persistent access for later, or use your server as a launch point for attacks elsewhere.
A fix has been released. This is not an unpatched zero-day sitting in the open -- a security update is available. The question is whether it has been applied to your specific setup yet.
Why This Is Not Just a Developer Problem
It is easy to read a headline about a compression library and assume it only matters to software developers managing complex infrastructure. For UK small businesses, though, the picture is more direct than that.
If your website runs on PHP -- and a very large proportion of small business websites do, often without the owner knowing the underlying technology stack -- then you may be running an environment that includes Brotli. The same applies if your hosting provider has enabled Brotli compression at the server level, which many shared hosting setups do by default to improve loading speeds.
You may not manage any of this directly. But that does not mean you are not exposed. As we have written about before, the window between a vulnerability being disclosed and attackers trying to exploit it is getting shorter. Waiting to see whether anything happens is not a reliable strategy.
What to Check Right Now
You do not need to be a developer to take sensible steps here. These are the right questions to ask:
- If you use managed hosting (a platform where someone else handles the server): contact your provider and ask specifically whether they have applied the Brotli security update. Most reputable providers will have done this already or will have a timeline. Get confirmation in writing.
- If you have an IT support partner or managed service provider: raise this with them directly. Ask whether Brotli is in use on any web-facing systems, and whether the patch has been applied.
- If you manage your own server or a virtual private server: check the version of the Brotli library installed and update to the patched release. If your setup includes PHP with Brotli support, check for updates there too. If you are not confident doing this, getting technical help is the right call rather than leaving it.
- If you use a WordPress or similar site: Brotli compression is typically handled at the hosting layer rather than the platform layer. The action is still to verify with your hosting provider directly.
This is also a useful moment to look at what running a PHP-based website means for your security posture more broadly. The underlying technology choices made by your platform have real security consequences, and knowing what you are running is the starting point for managing those risks.
The Broader Pattern Worth Recognising
Brotli is a good example of a category of risk that rarely makes it onto a small business owner's radar: vulnerabilities in infrastructure components that nobody thinks about until something goes wrong. Your website almost certainly relies on dozens of software components you have never heard of. Each of them can have flaws. The ones that matter most are the ones with network exposure -- and a compression tool sitting in the path of every single website request has exactly that kind of exposure.
This is precisely why regular vulnerability scanning matters for any business with a web presence. You cannot manually track every component in your stack. Automated scanning finds these exposures before someone with worse intentions does.
Having a standing process rather than a reactive one is what makes the real difference. Automated patch management means that when a fix like this lands, it gets applied as a matter of routine -- not left sitting on a to-do list until something forces the issue.
Practical Takeaway
You do not need to become an expert in web infrastructure to handle this well. You need to ask the right people one clear question: has the Brotli security update been applied to the systems running my website? If you cannot get a clear answer quickly, that itself tells you something important about your current security posture. Get in touch with the CyberStark team if you are unsure where to start.