PHP releases rebuilt Windows packages to fix Brotli CVE-2026-111497

PHP rebuilt its official Windows packages for versions 8.2‑8.5 (8.5.12‑1, 8.4.27‑1, 8.3.36‑1, 8.2.35‑1) to include Brotli 1.2.1 and close CVE‑2026‑111497, a memory‑corruption flaw reachable via the cURL extension.

Why it matters

Upgrade Windows PHP installations to the rebuilt packages to close CVE‑2026‑111497 and avoid code‑execution risk.

For product managers

For your product

What does this mean for your product?

Try it on your product

Read at The Hacker News

More from this issueAll AI news from 27 Oct →

OpenAI releases GPT-6.1 Terra with $1/$5 per million token pricingAvailable now

Apple launches iPad mini with OLED screen, A20 Pro chip and water resistanceAvailable now

Meta plans up to $95 billion stock sales to fund AI buildout

SoftBank reportedly plans $50 billion tech investment in MalaysiaUnconfirmed

Get this every morning, written for your product.

Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.

Request an invite See how it works