- Joined
- Dec 1, 2018
- Messages
- 3,647
These are coming in thick and fast....!!
PHP have issued another security update on 26th October but this one is for Windows builds not the core PHP release.
- Updated Windows packages: 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1. They bundle Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write during decompression. PHP’s runtime version stays unchanged.
- Exposure: PHP’s cURL extension can reach the vulnerable decoder when automatic HTTP-response decompression is enabled. That’s disabled by default, but applications or HTTP-client libraries can enable it.
- Separate reminder from 23 October: The 23 October advisory recommends session.upload_progress.enabled=0 pending the next regular release for an unusual session-handler RCE scenario. That is guidance, not another released core patch.
Check out more information about this security update here:
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
www.php.net
Have you fully patched your servers now?
