PHP rebuilds Windows packages to fix Brotli memory corruption flaw

PHP rebuilt its official Windows packages for versions 8.2 through 8.5 to fix a bundled Brotli vulnerability that can corrupt memory and potentially execute code, The Hacker News reported. The replacement packages include Brotli 1.2.1 and retain the previous PHP security fixes. An attacker could deliver a crafted compressed response from a server contacted by the application. Exposure requires automatic response decompression through cURL, which is off by default but enabled by some applications and libraries. The PHP version number remains unchanged, so running php -v cannot confirm the update. Administrators must check the package filename's -1 suffix and the download's SHA-256 hash to identify the rebuilt package.