The PHP engineering team has issued emergency Windows installer updates across 4 major release branches to patch a memory corruption flaw. The refreshed packages bundle Brotli 1.2.1 to resolve CVE 2026 111497, preventing potential out of bounds write exploits during data decompression. System administrators can obtain the updated binaries immediately through the official PHP Windows downloads portal.
The security flaw resides inside the Brotli decompression engine and affects Windows servers running the PHP cURL extension. Systems become exposed only when applications or HTTP client libraries explicitly configure cURL to decompress server responses automatically. While cURL disables this automated decompression by default, many modern web applications and third party API clients enable it to speed up network data transfers. Installing the updated packages replaces the vulnerable decoder and closes the memory exploit path.
The maintenance updates apply to PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team assigned a revision 1 suffix to each installer name to indicate that external dependencies were upgraded. The underlying PHP source code and core runtime behavior remain identical to previous releases, ensuring that deploying these binaries will not disrupt existing server configurations. IT administrators managing production Windows environments should apply these builds to safeguard their web services.
