PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has reissued its Windows installers for versions 8.2 through 8.5 just five days after its last emergency patch, this time to replace a vulnerable Brotli compression library bundled with the builds, tracked as CVE-2026-111497. The bug can corrupt memory and potentially allow code execution when PHP's cURL extension is configured to automatically decompress HTTP responses, a setting that libraries like Guzzle enable by default. The new packages—labeled 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1—now ship Brotli 1.2.1 instead of the flawed 1.2.0 and still retain last week's fixes for the separate PHP2Shell remote-code-execution issues. Google scores the flaw 9.2 (Critical) under CVSS 4.0, while Red Hat rates it 8.1 (Important); no active exploitation has been confirmed, though Imperva researchers demonstrated it against Node.js, and PHP urges Windows users to grab the updated builds identified by their file-name suffix and SHA-256 hash.