Editorial illustration; the terminal and checklist represent a maintenance workflow, not a real PHP installation.
Security updates do not always arrive as a dramatic new version number. Sometimes the important change is hidden in a rebuilt dependency, a package suffix or a new binary published for one operating system.
That is what happened with PHP’s latest Windows security update. On 26 October 2026, the PHP project announced updated Windows builds for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP version numbers did not change, but the builds now include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression.
This is separate from the two critical PHP2Shell vulnerabilities discussed in recent warnings. It is also not a Cloudflare Turnstile vulnerability. The risk is in a compression library used by certain PHP Windows builds, and it becomes relevant when an application uses cURL to decompress Brotli-encoded HTTP responses.
Quick Answer
If your website or PHP application runs on Windows, check whether it uses one of the affected PHP Windows builds and whether cURL can automatically decompress Brotli responses. Upgrade to the matching rebuilt package with the -1 suffix—such as PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1—from PHP’s official Windows downloads.
If your PHP server runs on Linux, macOS or another platform, this specific PHP Windows rebuild is not automatically a reason to replace your runtime. You should still check your operating system and PHP vendor’s security notices because dependencies may be packaged differently.
Do not judge the result only by running php -v. The command-line PHP binary may not be the same build used by IIS, Apache, a scheduled task or a web application. Verify the PHP runtime that actually serves requests.
What CVE-2026-111497 Actually Is
Brotli is a compression format and library used to make web responses smaller. A server can send compressed content, and a client such as cURL can decompress it before the application reads the response.
CVE-2026-111497 is an out-of-bounds write in Brotli decompression. In plain language, the decoder can write data outside the memory area it was meant to use when processing specially crafted compressed input. Memory-safety bugs can cause a crash, corrupt data or, under the right conditions, help an attacker execute code.
The PHP project’s notice says the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. It also says automatic decompression is disabled by default in cURL, but applications and HTTP client libraries can turn it on.
That last detail matters. “PHP on Windows” does not mean every Windows PHP request is exposed in exactly the same way. The practical risk depends on the PHP build, the cURL extension, the linked Brotli library and how the application handles remote HTTP responses.
Why the Version Number Is Easy to Miss
The rebuilt packages use names such as 8.5.12-1. The -1 is not a new PHP language release. It identifies a Windows package rebuild with updated dependencies, while the PHP runtime version remains 8.5.12.
This creates a common maintenance trap. An administrator may see “PHP 8.5.12” in a dashboard and assume that nothing changed. Another person may install the rebuilt package but report only the PHP runtime version, making it difficult to prove which dependency build is running.
Treat the package identity as part of the security state. For this issue, record the PHP branch, architecture, thread-safety type, build date and package suffix. A PHP 8.5 Thread Safe package and a PHP 8.5 Non-Thread Safe package are not interchangeable just because both display the same language version.
Who Should Pay Attention First?
Prioritise the following environments:
- PHP applications hosted directly on Windows Server.
- IIS or Apache installations using PHP’s Windows binaries.
- Windows development or staging servers that can access production services or credentials.
- PHP applications that use cURL, Guzzle or another HTTP client to fetch remote data.
- Integrations that accept remote content and enable Brotli response decompression.
- Systems where the PHP runtime is copied into a custom application bundle instead of managed by a central package process.
An ordinary PHP page that never makes outbound HTTP requests through cURL may not exercise the vulnerable path. That is useful context, but it is not a substitute for updating. Dependencies are often enabled by frameworks, plugins or shared libraries that an application owner does not remember configuring.
How to Check Your Installation
1. Identify the operating system and server path
First write down where PHP runs. Is it a Windows laptop, Windows Server with IIS, Apache on Windows, a container host, or a managed hosting panel? Identify the executable or service used by the web server rather than checking only the PHP installed in your terminal’s PATH.
2. Record the full PHP build information
Capture the output of the runtime’s version and information commands, including architecture, thread-safety status, compiler details and build date. Look for the package name in the folder, archive or hosting dashboard.
3. Check whether cURL is enabled
Look for the cURL extension in the web-serving PHP configuration. Then inspect the application code and dependencies for outbound HTTP requests. A project may use cURL indirectly through a framework, package manager, payment integration, image importer, webhook client or API SDK.
The important question is not “Does my code contain the word cURL?” It is “Can this PHP process receive remote HTTP content and ask cURL to decompress Brotli responses?” A dependency inventory or application owner may be needed to answer that properly.
4. Match the package to the official rebuild
The PHP project lists these updated Windows builds:
- PHP 8.5.12-1
- PHP 8.4.27-1
- PHP 8.3.36-1
- PHP 8.2.35-1
Select the correct architecture and thread-safety type for your server. Download from PHP’s official Windows distribution page or from a trusted vendor that has published an equivalent rebuild. Do not replace a production PHP directory with an archive from an unverified forum post.
5. Restart the service and verify the web path
Installing files is not the same as making the running service use them. Restart IIS, Apache or the relevant PHP worker process according to your deployment. Then repeat the check through the web-serving path.
If you use a process manager, application pool or service wrapper, confirm that the old executable is not still running. Check the service logs for startup errors, missing extensions and incompatible configuration before declaring the update complete.
What If You Cannot Update Immediately?
Contact the hosting or software vendor and ask specifically whether the PHP Windows package includes Brotli 1.2.1 and the CVE-2026-111497 fix. “We use PHP 8.5.12” is not enough if the issue concerns a rebuilt dependency package.
If your application does not require Brotli response decompression, ask whether the feature can be disabled safely at the HTTP client or application level while you arrange the proper update. Test this in staging first. A temporary configuration change can cause API responses to fail, increase bandwidth or break a library that expects compressed content.
Do not treat a web application firewall as a complete fix for a local decompression bug. A WAF may reduce some request patterns, but it cannot guarantee that every dangerous compressed response or application path is removed. The durable fix is the vendor’s corrected build.
Common Mistakes
Updating the wrong PHP installation
The PHP command in your terminal, the PHP used by a scheduled job and the PHP used by IIS can be different. Verify each security-relevant runtime.
Assuming the same version means the same package
The -1 rebuild keeps the PHP version number but updates a bundled dependency. Record the package suffix and build date, not only the major and minor version.
Downloading a random replacement archive
Security work is a bad time to introduce an unknown binary. Use the PHP project, your operating-system vendor or your hosting provider. Verify checksums where the vendor publishes them.
Disabling cURL without checking the application
Turning off an extension may stop payment callbacks, API integrations, update checks or background jobs. It can also create a false sense of safety if another HTTP client still uses the vulnerable library.
Forgetting staging and backup systems
A forgotten staging server can still hold credentials or provide a path into a trusted network. Include development, test, backup and disaster-recovery hosts in the inventory.
How This Relates to PHP2Shell and Turnstile
Several PHP security stories are now being discussed at the same time, so names can blur together.
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, the two critical PHP engine vulnerabilities released on 21 October. They affect broader PHP server configurations and have different technical causes.
CVE-2026-111497 is a Brotli dependency issue in updated Windows PHP builds. It is reached through a particular decompression path involving cURL. Its scope and update mechanism are different.
Cloudflare Turnstile is a bot-detection service. A Turnstile token-validation mistake can allow form spam, but Turnstile is not the Brotli library and is not the component named in this PHP advisory. Updating PHP does not replace server-side Turnstile validation, and correctly validating Turnstile does not patch PHP.
My Take
The most useful lesson is that “What PHP version are you running?” is sometimes an incomplete security question. You also need to know which build, which operating system, which bundled libraries and which extensions are active in the real web-serving process.
This does not mean every small website owner needs to become a Windows binary engineer. It means that a hosting support request should be specific. Ask for the actual package build, the patched dependency version and confirmation that the web-serving workers were restarted.
I also prefer recording the update as an evidence trail: old build, new build, service restart time, test result and the person or vendor responsible. That short record is far more useful during the next security warning than a vague note saying “PHP updated”.
Bottom Line
CVE-2026-111497 is a real security issue in Brotli decompression, but the PHP project’s notice narrows the immediate concern to particular Windows builds and cURL usage. Check your actual runtime, upgrade to the matching -1 Windows build, restart the serving service and verify the result through the web path.
Do not confuse this advisory with PHP2Shell or Cloudflare Turnstile. The names are appearing in the same security conversations, but the components and fixes are different. Clear identification is the first step toward a useful patch.