PHP Updates Windows Builds for Critical Brotli Flaw (CVE-2026-111497)

The PHP team released new Windows builds on 26 October 2026 for all supported versions, addressing a critical vulnerability in the Brotli decompression library. Anyone running Windows servers with PHP and using the cURL extension for outbound HTTP calls should update immediately.

The patched versions

The updated builds are PHP 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1, with Brotli 1.2.1 fixing CVE-2026-111497—an out-of-bounds write vulnerability in Brotli decompression. The -1 suffix marks a recompilation of the Windows package with updated dependencies: the PHP source and runtime version itself has not changed.

Where the risk lies

On Windows, PHP's cURL extension can invoke the vulnerable decoder when automatic decompression of HTTP responses is active—disabled by default in cURL but enabled by applications and third-party HTTP client libraries. In practice: if your code or a third-party library sets CURLOPT_ENCODING to accept Brotli-compressed responses, your server is exposed.

The public CVE record assigns the flaw a CVSS score of 9.2 Critical, describing an unauthenticated remote attacker who can corrupt adjacent memory in the decoder state, potentially leak sensitive memory contents, cause denial of service, or execute arbitrary code by sending a specially crafted Brotli-compressed stream.

Not the first patch this week

This is not an isolated emergency: it's the second security fix for PHP Windows builds in just days. The recompiled builds, numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, arrive five days after the 21 October releases that fixed two RCE flaws known as PHP2Shell. They use the same source code, so those fixes remain in place, and now include Brotli 1.2.1.

The Brotli flaw, for that matter, did not originate in PHP: Node.js reported it in its 21 October security release, and researchers initially called it Node2Shell. Brotli is a library shared across many runtimes and proxies, so the same CVE required separate patches across multiple ecosystems in the same week.

What to do

Administrators of Windows servers running PHP should download the updated packages from the official PHP downloads page (php.net/downloads.php?os=windows) and verify, before updating, whether any applications or libraries in use enable CURLOPT_ENCODING for Brotli—that's the attack vector that makes this flaw exploitable.