PHP released rebuilt Windows packages on October 26 to replace a vulnerable Brotli decompression library. Administrators who installed last week's PHP security releases have a separate package update to check.
The PHP team's announcement lists four replacement builds:
- PHP 8.5.12-1
- PHP 8.4.27-1
- PHP 8.3.36-1
- PHP 8.2.35-1
Each bundles Brotli 1.2.1 to address CVE-2026-111497, an out-of-bounds write flaw. The suffix identifies rebuilt Windows packages with updated dependencies. PHP's source releases and runtime version numbers remain unchanged, so the runtime number alone does not distinguish these packages from the earlier builds.
On Windows, PHP says the vulnerable decoder is reachable through its cURL extension when automatic HTTP response decompression is enabled. cURL leaves that behavior disabled by default, but applications and HTTP client libraries can turn it on.
The replacement packages are available through the download link in PHP's announcement.
A shared library flaw
Google's Brotli 1.2.1 release notes describe the vulnerability as permitting remote code execution. Brotli also appears inside other software, which requires its own updates.
The Node.js project's October 21 security advisory explains that malformed compressed data can cause its bundled decoder to write beyond an internal buffer. An attacker must be able to supply Brotli data that an application decompresses. The possible consequences include a crash, disclosure of process memory or remote code execution.
That Node.js advisory covers the 26.x, 24.x and 22.x release lines. Updating PHP's Windows package does not update a separately installed Node.js runtime.
Today's Windows rebuild is also separate from PHP's October 21 fixes for CVE-2026-109618 and CVE-2026-109619. Those earlier vulnerabilities affect PHP installations serving web requests. For a Windows deployment already on one of those fixed PHP releases, the additional question is whether its installed package includes the new Brotli dependency.
