PHP has released rebuilt official Windows packages for PHP 8.2 through 8.5 to resolve CVE-2026-111497 in the Brotli compression library.
The memory corruption issue is reachable via cURL when automatic HTTP response decompression is enabled.
Developers running Windows environments should verify updated package builds.
The new releases target PHP 8.2 through 8.5 and fix a vulnerability in the Brotli compression library included in Windows packages that could allow someone to corrupt system memory and potentially execute commands.
How could the problem be triggered?
According to the warning, the issue could be accessed when the system automatically decompresses data received from the internet. This feature is automatically enabled by some popular libraries used by developers.
For example, the Guzzle library enables automatic decompression by default. This meant that applications that maintained the library's default settings were eligible to experience the issue in Windows packages released last week.
How will you know you have installed the new version?
The updated packages are numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 and now contain the corrected version of the compression library.
READ ALSO
GitLab fixes serious security flaw that existed since 2014
The developers recommend that Windows users install the new versions directly from the official download page. Because the PHP base number remains the same on the screen, users can identify the new files by the additional token in the file name and the special verification code that accompanies them.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)