The PHP team has rebuilt its supported Windows packages with Brotli 1.2.1, addressing CVE-2026-111497, an out-of-bounds write flaw that can potentially lead to remote code execution. ⠀ In PHP’s Windows builds, the vulnerable Brotli decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This cURL feature is disabled by default, but applications and HTTP client libraries can turn it on. ⠀ Updated builds: • PHP 8.5.12-1 • PHP 8.4.27-1 • PHP 8.3.36-1 • PHP 8.2.35-1 ⠀ The “-1” suffix indicates that the Windows packages were rebuilt with updated dependencies. The PHP source and runtime version numbers remain unchanged. This is separate from the PHP2Shell flaws patched on October 21.   submitted by   /u/acealter   to   r/HackerAlerts [link]   [comments]