Just days after a routine security update, PHP has rushed out rebuilt Windows packages for versions 8.2 through 8.5. The culprit isn't a flaw in PHP itself, but a critical vulnerability (CVE-2026-111497) in the bundled Brotli compression library that opens the door to memory corruption and potential remote code execution.
The rebuilt packages, numbered8.5.12-1,8.4.27-1,8.3.36-1and8.2.35-1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.
What makes this vulnerability particularly notable is how easily it can be triggered. The exploit relies on a PHP application receiving a maliciously crafted compressed response from a server. While PHP's cURL extension leaves automatic decompression off by default, widely used HTTP clients like Guzzle enable it automatically. If your application relies on Guzzle's default settings to make external requests, it is exposed to the flaw.
While agencies like CISA report no active exploitation yet, the flaw carries a critical 9.2 CVSS score, and researchers have already successfully executed code via this vulnerability in other environments like Node.js.
How to secure your systems:
Patch immediately
Install the new -1 builds (e.g., 8.5.12-1). Because the base PHP version is unchanged, running php -v won't confirm the patch—you must verify the -1 in the filename or check the SHA-256 hash from PHP's downloads page.
Apply the workaround
If you cannot update immediately, OpenAI—who discovered the flaw—advises disabling automatic decompression. In plain PHP, avoid setting CURLOPT_ENCODING.
If using Guzzle, explicitly set the decode_content request option to false. Note that this halts all automatic decoding, meaning standard gzip responses will also arrive compressed.
