The PHP development team released updated Windows packages to address a memory corruption vulnerability in Brotli decompression, which could potentially allow for remote code execution This article explores windows updates php. . This issue was announced on October 26, 2026, and the rebuilt packages include Brotli 1.2.1 and cover four PHP release branches.
The updated builds are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1.
PHP Releases Urgent Windows Updates The PHP announcement highlights that certain Windows applications can be vulnerable to Brotli decoder exposure through the cURL extension when automatic HTTP response decompression is enabled. By default, cURL does not enable automatic response decompression, but applications and HTTP client libraries can choose to enable it, making it difficult to detect exposure solely based on cURL's default behavior.
Therefore, administrators should review application settings and library configurations to identify and address any Windows deployments that require immediate attention. PHP’s installation guidance specifies Non-Thread Safe builds for FastCGI and command-line use, while Thread Safe builds support multithreaded server-module deployments. The PHP announcement lacks a CVSS score or active exploitation reports, so confirmed findings include an out-of-bounds write in the decoder, documented cURL exposure conditions, and the availability of rebuilt Windows packages with the corrected Brotli dependency.
