We checked this claim: is it true that
PHP issued a second set of Windows security builds to patch a critical Brotli decompression flaw?
PHP released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 bundling Brotli 1.2.1
PHP rushes new Windows fixes after upstream flaw
Developers shipped four replacement packages on October 26 after discovering a bundled compression tool exposed servers to memory corruption.
In a nutshell
Five days after patching emergency remote code execution flaws in its core engine, PHP released secondary Windows binary packages to fix a severe memory-writing bug in Google's bundled Brotli compression tool. Because core PHP code was not rewritten, the packages carry only a minor "-1" revision mark, meaning standard version-checking commands show no change and server operators must manually swap files and reboot services to stay safe.
Highlights
- PHP released four rebuilt Windows packages—8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1—bundling Brotli 1.2.1 on October 26, 2026.
- The Brotli vulnerability, tracked as CVE-2026-111497, causes an out-of-bounds memory write during data decompression.
- The secondary Windows release arrived five days after PHP patched two unrelated critical core flaws dubbed PHP2Shell on October 21, 2026.
- Running the standard 'php -v' command does not display the "-1" suffix, requiring administrators to check file timestamps or archive contents directly.
From the Editor’s Diary
Patching core application code solves nothing when pre-packaged auxiliary tools carry inherited vulnerabilities of their own. When packaging numbers mask underlying fixes, manual verification remains the only barrier against silent exposure.
Who's involved
PHP Development Team
Open-source release engineers who maintain the PHP website programming engine
goal → Secure the core code and supply fixed prebuilt program files to users
Google Brotli Maintainers
Software engineers who build Google's open-source file compression tool
goal → Fix memory management errors inside data unpacking routines
Windows System Administrators
Information technology engineers who run PHP website systems on Windows servers
goal → Stop unauthorized system access by replacing old program files and restarting web services
In short
Servers running PHP on Windows face memory corruption unless administrators manually swap out their software files, after a hidden flaw inside a bundled data tool reopened risks five days after an earlier fix.
System administrators operating Windows servers must now download revised packages and restart their web services to replace the vulnerable components.
This requirement is near-certain because the underlying core program code remains unchanged, meaning standard automated version checks will not trigger an alert or detect the fix on their own.
How it unfolded
Security fixes reveal secondary flaw across web runtimes
On October 21, 2026, the PHP development team issued emergency fixes for two critical system-hijacking vulnerabilities known as PHP2Shell, cataloged as CVE-2026-109618 and CVE-2026-109619. On the same day, downstream software groups such as Node.js disclosed a separate out-of-bounds memory write bug in Google's Brotli compression library, cataloged as CVE-2026-111497. The decompression bug spread quickly across multiple programming environments that rely on pre-packaged Brotli components.
Upstream compression bug reaches Windows website packages
As security researchers tracked CVE-2026-111497 across environments including Python, .NET, and cURL, maintainers realized that official Windows PHP packages carried vulnerable Brotli code through their bundled cURL internet data transfer extension. Servers configured to decompress web responses automatically were left open to corrupted memory heaps.
Where things stand
The core claim is confirmed. Official Windows packages 8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1 are available for download on windows.php.net and discourse.thephp.foundation.
Windows system administrators must manually install the replacement files and restart all running web worker services. Standard command checks using "php -v" continue to display the base version number without the revision tag, leaving archive file details and build timestamps as the only ways to verify that the repair took effect.