Updated PHP Windows builds for Brotli security fix

Hosting Support
1

Website URL

Error Message

The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression.

In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.

The -1 suffix identifies a Windows package rebuild with updated dependencies. These builds use the same PHP source releases, and the PHP runtime versions remain unchanged.

Other Information

Is there anything client can do about this?

2

Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.

I couldn’t find anything in our knowledge base or on the forum about this PHP announcement, so I can’t say whether it affects InfinityFree hosting or whether a client can do anything about it.

Is this about a site of yours on InfinityFree, for example one making cURL requests that show an error? If so, what’s the exact error text, and what’s the website address? The link you gave is the PHP site, not yours.

3

Free hosting runs on Linux. There’s nothing to do.

4

Noted