## Updated PHP Windows builds for Brotli security fix

- 種別: release
- 関連技術: php, windows
- CVE: CVE-2026-111497
- 公開日時: 2026-10-26T11:57:45.000Z
- 情報源: PHP News (https://www.php.net/index.php#2026-10-26-1)
- パーマリンク: https://vulnpulse.app/items/php-news-beb5a242d700

The PHP team announces updated Windows builds: . These builds include Brotli 1.2.1, which fixes , an out-of-bounds write vulnerability in Brotli decompression. PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 CVE-2026-111497 In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it. The suffix identifies a Windows package rebuild with updated dependencies. These builds use the same PHP source releases, and the PHP runti…