Updated PHP Windows builds for Brotli security fix
Unrated · fetched 2026-10-27
The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 . These builds include Brotli 1.2.1, which fixes CVE-2026-111497 , an out-of-bounds write vulnerability in Brotli decompression. In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it. The -1 suffix identifies a Windows package rebuild with updated dependencies.
Remediation
Update PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches below 8.2 have no fixed release — upgrade the branch or take the site offline.
Affected PHP branches
PHP 8.5 → fixed in 8.5.12
Source: PHP.net News · retrieved 2026-10-27T04:20:11-04:00 · https://www.php.net/index.php#2026-10-26-1