PHP has released rebuilt official Windows packages for PHP 8.2 through 8.5 to resolve CVE-2026-111497 in the Brotli compression library.

The memory corruption issue is reachable via cURL when automatic HTTP response decompression is enabled.

Developers running Windows environments should verify updated package builds.

The new releases target PHP 8.2 through 8.5 and fix a vulnerability in the Brotli compression library included in Windows packages that could allow someone to corrupt system memory and potentially execute commands.

How could the problem be triggered?

According to the warning, the issue could be accessed when the system automatically decompresses data received from the internet. This feature is automatically enabled by some popular libraries used by developers.

For example, the Guzzle library enables automatic decompression by default.…