PHP has issued another Windows security update, this time rebuilding its official Windows packages for PHP 8.2 through 8.5 to address CVE-2026-111497. The issue affects the bundled Brotli compression library and could allow memory corruption and potentially remote code execution in specific conditions.

For businesses running PHP applications on Windows, the update matters because the vulnerable code may be reachable through PHP's cURL extension when HTTP responses are automatically decompressed. That creates a potential risk in environments where applications fetch data from external services, APIs or third-party platforms.

What happened

According to the reported advisory, PHP rebuilt its official Windows packages after identifying that the included Brotli library contained a flaw tracked as CVE-2026-111497. The issue is described as a memory corruption vulnerability with possible code execution impact.

PHP said the vulnerable path can be triggered through the cURL extension if it is configured to automatically decompress HTTP responses. The source notes that cURL does not enable this behaviour by default, which may limit exposure, but organisations should not assume they are unaffected without reviewing application settings and dependencies.

Why it matters for European businesses

This is a practical infrastructure security issue rather than a theoretical one. Many business websites, e-commerce systems, internal dashboards and integrations rely on PHP and use cURL to connect to payment providers, logistics systems, CRMs, marketplaces and other external services.

If a PHP application on Windows is set up to automatically decompress remote HTTP responses, a malicious or compromised upstream service could potentially exploit the flaw. In business terms, that could put web servers, application data and connected systems at risk.

The issue is especially relevant for companies with mixed legacy environments, where PHP on Windows may still support internal tools, line-of-business applications or custom integrations that do not always receive the same patching attention as public-facing platforms.

Who may be affected

• Businesses hosting PHP applications on Windows servers, especially custom web applications and internal tools.
• E-commerce companies using PHP-based platforms or middleware that connect to external APIs.
• Development and IT teams maintaining Windows-based PHP runtimes from the official PHP packages.
• Digital agencies and managed service providers responsible for maintaining client websites or integrations on Windows infrastructure.

Linux-based PHP deployments are not the focus of this specific package rebuild described in the source. The immediate issue concerns the official Windows builds that include the affected Brotli library.

What companies should consider

• Identify affected systems by checking whether your organisation uses official PHP Windows packages for versions 8.2, 8.3, 8.4 or 8.5.
• Update promptly to the rebuilt Windows packages released by PHP.
• Review cURL usage in applications, especially whether automatic HTTP response decompression has been enabled.
• Audit external integrations that fetch compressed content from third-party APIs or remote services.
• Check custom and legacy applications that may not be covered by routine patch management.
• Monitor for unusual behaviour on affected servers, including crashes, instability or unexpected outbound activity that could indicate attempted exploitation.

For most organisations, the immediate priority is straightforward: verify whether PHP on Windows is in use, determine whether cURL decompression is enabled anywhere in the application stack, and apply the rebuilt packages where relevant.