In brief
- All four rebuilt Windows packages carry the -1 suffix.
- PHP’s internal version does not change with this rebuild.
What was released today
On October 26, 2026, the PHP project published rebuilt Windows packages: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write during decompression.
The -1 suffix identifies the package rebuild. The version reported by the PHP interpreter itself does not change. Think of replacing a component without renaming the whole device: check the installed package, not just its main version label.
Scope matters
The advisory describes a possible route through the cURL extension when automatic decompression of HTTP responses is enabled. That option is off by default in cURL, although an application or library can turn it on.
This does not mean every PHP website has been attacked. Nor can a website’s security status be inferred simply from its use of PHP, Windows or a particular provider. The actual installation and how it is used matter.
What to ask the service operator
If you administer an affected installation, consult the official packages and verify the rebuild for your branch, architecture and build type. For a hosted service, ask the provider to confirm the deployed package and whether the dependency is part of the environment.
Before updating production, keep a backup and validate the change through the usual maintenance process. Ordinary website visitors do not need to download PHP for this: server and application operators handle it. This article explains the advisory; it does not certify any particular website’s security.
Sources and context
Sources used for this article. Follow the links to read the original material.
See the linked sources for more information. Corrections and contact →
