Original announcement: · Reporting prepared on the publication date above.
What to know
- The -1 suffix distinguishes the rebuilt Windows package.
- Review HTTP clients that automatically decompress responses.
- Verify the running installation and record application checks.
What changed on October 26
The PHP project announced rebuilt Windows packages on 26 October 2026: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1. The official notice explains that the suffix identifies a dependency rebuild; the PHP runtime version itself stays the same.
Why response compression matters
The Brotli release fixes CVE-2026-111497, an out-of-bounds write in decompression. PHP identifies cURL with automatic response decompression enabled as a reachable path in its Windows builds. This option is disabled by default in cURL, but an application library can enable it. Check the PHP cURL option reference when reviewing your HTTP client configuration.
Build an application inventory
Our suggested review starts with a small worksheet: machine, PHP installation path, package filename, owner, external HTTP integrations and last successful update. Include background import jobs and scheduled tasks alongside the public website. Ask developers which integrations download responses automatically and which library controls decoding. That gives the administrator a concrete set of applications to verify.
Validate the replacement
On an affected Windows installation, obtain the replacement from the official distribution channel. Preserve the current extension list and configuration, then test the change in a separate environment. Use normal, trusted responses to exercise imports, API calls and scheduled work. Record the complete package identity and confirm that restarted application workers use that installation. A screenshot of the short PHP version banner cannot distinguish these rebuilt packages.
Keep separate update records
This Windows dependency announcement has a different scope from the October 21 PHP runtime security fixes. For Linux or a hosting vendor’s custom packages, request that vendor’s applicable advisory and package evidence rather than installing a Windows archive. Keep one maintenance record for each platform, with application checks and the person responsible for follow-up. If you need help identifying a mixed environment, send the installation details through Kiava IT services.
Sources & further reading
Primary sources supporting this article. The practical recommendations are Kiava’s general guidance and should be adapted to your project.