PHP on Windows: CVE-2026-111497 Brotli out-of-bounds write reachable through the cURL extension. Which PHP Windows builds are fixed (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) and how do I tell if I have them?

What it is: on October 26, 2026 the PHP team published rebuilt official Windows packages, PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, that bundle Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write in Brotli decompression that can cause memory corruption and possibly code execution. In PHP Windows builds the vulnerable decoder is reached through the cURL extension when automatic HTTP response decompression is turned on. cURL has it off by default, but applications and HTTP client libraries can turn it on, for example by setting CURLOPT_ENCODING to an empty string or by clients such as Guzzle that decode compressed responses automatically. That means a malicious or compromised server your PHP code fetches from could send a crafted compressed response. Am I affected: - Official PHP Windows builds (php.net / windows.php.net zip packages) of 8.2 to 8.5 that don't have the -1 suffix, used with ext-curl to fetch from servers you don't fully control. - Linux and other distro packages are separate: they use the system Brotli and curl, which your distribution updates (see the Brotli listings for libbrotli). Docker official php images on Linux follow the distro. - How to check: php -v shows the same version before and after the rebuild, so check the download file name (for example php-8.5.12-1-nts-Win32-vs17-x64.zip) or compare the SHA-256 of your package with the hashes on the PHP Windows downloads page. php -i | findstr /i brotli can also show the bundled Brotli version in the curl section. Fix: replace your PHP installation with the -1 rebuild for your branch (8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1), keeping your php.ini and extensions, then restart PHP-FPM / IIS FastCGI / Apache. These builds also already include the PHP2Shell fixes released on October 21. Interim mitigation: don't enable automatic decompression. Don't set CURLOPT_ENCODING to an empty string or to a list including br, and in Guzzle set the decode_content request option to false (or to a value without br) for requests to untrusted servers. After: confirm the deployed file name or hash, and remember that third-party Windows PHP bundles (XAMPP, WampServer, Laragon and similar) need their own updates. Sources: https://www.php.net/archive/2026.php#2026-10-26-1 https://thehackernews.com/2026/10/php-issues-second-windows-security.html https://github.com/google/brotli/releases/tag/v1.2.1