PHP Releases Second Windows Patch in a Week to Close Critical Brotli Vulnerability

PHP has issued a fresh set of Windows binaries for its 8.2 through 8.5 series, addressing a severe flaw in the bundled Brotli compression library identified as CVE-2026-111497. The vulnerability, which can be triggered to corrupt memory and potentially execute arbitrary code, prompted the PHP development team to rebuild the affected packages and make them available for download.

The update arrives just five days after an earlier security release, marking the second Windows‑focused patch in a short span. Both releases target the same underlying issue in Brotli, a widely used data‑compression algorithm that PHP incorporates for handling compressed HTTP responses and other payloads. By correcting the library code, the new builds eliminate the attack surface that could otherwise be exploited by malicious actors.

According to the PHP security advisory, the flaw is reachable through typical usage patterns of the compression extension, meaning that any PHP application running on Windows and employing Brotli could be at risk. While the advisory does not detail specific exploit scenarios, the potential for remote code execution makes the vulnerability a high priority for administrators.

Windows users of PHP are advised to replace their existing installations with the freshly compiled binaries as soon as possible. The PHP project has provided download links for each supported version, and the packages are signed to verify integrity. System administrators should also review their deployment procedures to ensure that the updated binaries are propagated across development, staging, and production environments.

The rapid succession of patches underscores PHP's commitment to security, especially after recent high‑profile incidents involving third‑party libraries. By rebuilding the entire Windows distribution rather than issuing a simple patch to the Brotli component, the PHP team aims to guarantee that no residual code paths remain vulnerable.

Looking ahead, the PHP community expects continued monitoring of third‑party dependencies, with additional updates likely if further issues emerge. Users are encouraged to stay informed through the official PHP security mailing list and to adopt best practices such as regular updates and code audits to mitigate future risks.