PHP refreshes Windows 8.2–8.5 builds to patch Brotli cURL flaw

Key points

• PHP maintainers recompiled Windows packages for PHP 8.2 through 8.5.
• The refresh fixes a Brotli library flaw affecting the cURL extension.
• CVE-2026-111497 involves memory corruption with possible code execution.
• This is the second package update in a five-day period.
• Windows-based PHP deployments should update and verify extension versions.

PHP maintainers have reissued Windows builds for PHP versions 8.2 through 8.5 after addressing a defect in the Brotli compression library. The flaw is tracked as CVE-2026-111497 and touches the cURL extension, which can rely on Brotli for compressed HTTP responses. According to the available details, the issue can cause memory corruption and may permit code execution under certain conditions.

The update is notable for its timing: it is the second refresh of PHP Windows packages within a five-day span. Maintainers rebuilt the affected packages and applied a patch for the Brotli problem. The vendors named in the advisory are the PHP project and Brotli, and the products in scope are PHP Windows packages, the Brotli library, and the cURL extension.

Most K-12 districts do not run PHP directly on Windows endpoints, but some administrative tools, legacy web applications, or vendor-supplied services may. For those environments, the practical risk depends on whether untrusted input reaches the cURL/Brotli path. Memory corruption bugs are worth treating seriously because they can undermine service stability and, in the worst case, allow an attacker to run code.

Because the severity hint is informational, teams should avoid panic but still confirm exposure. The key question is whether any Windows host runs PHP 8.2–8.5 with the cURL extension enabled and processes content from outside the trusted network. If so, the rebuilt packages should be applied promptly and tested against the affected applications.

Watch for follow-up advisories from PHP maintainers, updated package hashes, and any clarification about exploitability. Also track whether downstream vendors bundle the affected Windows PHP builds. A quick inventory now will make the next refresh easier to handle.

What to do now

1. Inventory Windows servers and workstations running PHP 8.2–8.5; record whether the cURL extension and Brotli support are enabled.
2. Download and deploy the latest rebuilt PHP Windows packages from the official PHP source; verify checksums and signatures before installation.
3. After updating, confirm the PHP version and cURL/Brotli extension versions, then restart dependent web services.
4. Test affected applications for normal HTTP compression and cURL behavior; roll back only with a documented compensating control if testing fails.
5. Limit network exposure for any Windows PHP service that cannot be patched immediately; restrict inbound access and monitor logs.
6. Track CVE-2026-111497 and PHP maintainer advisories for updated guidance or additional rebuilds.
7. Ask third-party vendors whether their Windows PHP bundles include the patched Brotli and cURL components.

CVE references

• CVE-2026-111497

Original source

The Hacker News