# Updated PHP Windows builds for Brotli security fix

- Thread: https://externals.io/message/132933
- Original archive: https://news-web.php.net/php.internals/132933
- Started by Shivam Mathur on 2026-10-26T15:49:24+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #132933 — Shivam Mathur — 2026-10-26T15:49:24+00:00

URL: https://externals.io/message/132933#132933

The PHP team announces the immediate availability of updated Windows
builds:

- PHP 8.2.35-1
- PHP 8.3.36-1
- PHP 8.4.27-1
- PHP 8.5.12-1

These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an
out-of-bounds write vulnerability in Brotli decompression.

On Windows, PHP's cURL extension can invoke the affected decoder when
automatic HTTP response decompression is enabled. This is disabled by
default in cURL, but applications and HTTP client libraries may enable
it.

PHP Windows users are advised to update to these builds.

The -1 suffix marks a Windows package rebuild with updated dependencies.
The PHP source and runtime versions have not changed.

Release announcement: https://www.php.net/archive/2026.php#2026-10-26-1

Windows downloads: https://www.php.net/downloads.php?os=windows

Regards,
Shivam Mathur