PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has released rebuilt Windows packages for PHP 8.2 through 8.5 to address CVE-2026-111497, a critical vulnerability in the Brotli compression library bundled with the packages. The flaw allows attackers to corrupt memory and potentially execute arbitrary code. The vulnerability is reachable via the cURL extension when it automatically decompresses HTTP responses, though this behavior is disabled by default. This is the second Windows-specific security update PHP has issued within five days, indicating ongoing scrutiny of third-party library dependencies. The fix involved rebuilding official Windows binaries rather than a simple patch. Users running PHP on Windows with the affected versions should update immediately. The issue highlights risks associated with bundled third-party libraries in language runtimes. Organizations using PHP on Windows in web-facing environments are most at risk.