PHP rebuilds Windows packages to patch Brotli security flaw

First reported by Cyber Security News at · Updated · 2 sources

The updated packages cover PHP 8.2 through 8.5 and address CVE-2026-111497 in the bundled compression library. According to The Hacker News, the flaw could cause memory corruption and potentially allow code execution through cURL’s automatic HTTP response decompression. That decompression setting is disabled by default, the publication reports.

  • The builds include Brotli 1.2.1, according to Cyber Security News.
  • The Hacker News calls this PHP’s second Windows security update in five days.

Covered by 2 publishers within 2 hours of the first report.

Reporting2

Cyber Security News PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability · Guru Baran
The Hacker News PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw · info@thehackernews.com (The Hacker News)

Related

Microsoft breaks Patch Tuesday record with more than 1,000 Windows security flaws fixed
NSA warns organizations to patch security flaws identified by AI