The PHP team announces the immediate availability of updated Windows
builds:
- PHP 8.2.35-1
- PHP 8.3.36-1
- PHP 8.4.27-1
- PHP 8.5.12-1
These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an
out-of-bounds write vulnerability in Brotli decompression.
On Windows, PHP's cURL extension can invoke the affected decoder when
automatic HTTP response decompression is enabled. This is disabled by
default in cURL, but applications and HTTP client libraries may enable
it.
PHP Windows users are advised to update to these builds.
The -1 suffix marks a Windows package rebuild with updated dependencies.
The PHP source and runtime versions have not changed.
Release announcement: https://www.php.net/archive/2026.php#2026-10-26-1
Windows downloads: https://www.php.net/downloads.php?os=windows
Regards,
Shivam Mathur