If you run PHP on Windows using the official php.net builds, download the zip again. The PHP team just published updated Windows builds for PHP 8.2, 8.3, 8.4, and 8.5 that bundle Brotli 1.2.1. That release fixes CVE-2026-111497, an out-of-bounds write in Brotli decompression.

The new builds are:

  • PHP 8.5.12-1
  • PHP 8.4.27-1
  • PHP 8.3.36-1
  • PHP 8.2.35-1

Who Is Affected

The Brotli decoder ships in the Windows zips as brotlidec.dll, next to the cURL extension. According to the php.net announcement, PHP code can reach the vulnerable decoder through cURL when automatic HTTP response decompression is turned on. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.

All four rebuilt branches have x64 and x86 zips in both Thread Safe and Non Thread Safe variants. Grab the one that matches your current install from the Windows downloads page.

The CVE record lists Brotli 1.0.3 through 1.2.0 as affected and rates the bug 9.2 (critical) under CVSS 4.0. It says a crafted Brotli stream can corrupt memory, leak memory contents, crash the process, or potentially run code.

The announcement only covers 8.2 through 8.5. The PHP 8.1 Windows builds weren't rebuilt and are still dated December 2025. The PHP 8.6.0RC4 Windows pre-release builds are dated October 21.

Not the php2shell Bugs

This is a separate issue from the two critical remote code execution bugs that PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixed on October 21. Those were bugs in PHP itself. This one lives in a library the Windows builds bundle. If you already updated for php2shell, you still need the -1 build on Windows.

For more details, read the full announcement on php.net, and happy updating!