This update addresses CVE-2026-111497, a vulnerability residing within the Brotli compression library integrated into these packages.
The security flaw permits an attacker the capability to corrupt memory and potentially execute code.
According to PHP, this vulnerability can be exploited via the cURL extension. The attack vector involves the extension automatically decompressing HTTP responses.
Although cURL defaults to disabling this automatic decompression, the vulnerability remains a concern.
This rapid patch cycle demonstrates the ongoing necessity for maintaining secure dependencies within platform tooling.
Market participants utilizing these PHP environments must ensure they are running the newly built official Windows packages to mitigate the risk associated with this library flaw.
