# PHP rebuilds Windows packages to fix Brotli memory corruption flaw

_Published Monday, October 26, 2026 at 11:20 PM EDT · Security · Latest · Tier 2 — Notable_

![PHP rebuilds Windows packages to fix Brotli memory corruption flaw — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWGYEqFaRxRywsWzBt-2T2G_Jpdp4zy3iV7qI1alNGRaBf_8TMdzRQQb335GhASkVoXD3q9mGkiLjAog4ez9d7DHhl88lkNVvuhI74KiKZP0zZpb2O8yyqyDw12WoYTiGaq1AVfG9TfGcdNhP-DmRwuKJ4Pj4mr9rEo-TVLYxYSpmUogJUSFZFL_VaduQ/s1700-nu-rw-lo-l85-e365/php-windows.jpg)

PHP rebuilt its official Windows packages for versions 8.2 through 8.5 to fix a bundled Brotli vulnerability that can corrupt memory and potentially execute code, The Hacker News reported. The replacement packages include Brotli 1.2.1 and retain the previous PHP security fixes.

An attacker could deliver a crafted compressed response from a server contacted by the application. Exposure requires automatic response decompression through cURL, which is off by default but enabled by some applications and libraries.

The PHP version number remains unchanged, so running php -v cannot confirm the update. Administrators must check the package filename's -1 suffix and the download's SHA-256 hash to identify the rebuilt package.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/php-issues-second-windows-security.html)

---
Canonical: https://techandbusiness.org/newswire/rd2qCOsBpKKdt-pspZGxBQ
Published: 2026-10-27T03:20:01.997Z
Story chronology: 2026-10-26T17:45:57.000Z
Retrieved: 2026-10-27T06:36:50.112Z
Publisher: Tech & Business (techandbusiness.org)