# Updated PHP Windows builds for Brotli security fix

**URL:** <https://forum.infinityfree.com/t/updated-php-windows-builds-for-brotli-security-fix/121601>\
**Category:** Hosting Support\
**Created:** [October 27, 2026, 6:36am UTC](https://forum.infinityfree.com/t/updated-php-windows-builds-for-brotli-security-fix/121601 "2026-10-27T06:36:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mr\_Craft](https://forum.infinityfree.com/letter_avatar/mr_craft/32/5_5575768a8748004e209b776fc1b2916d.png) [@Mr\_Craft](https://forum.infinityfree.com/u/Mr_Craft)\
**Post date:** [October 27, 2026, 6:36am UTC](https://forum.infinityfree.com/t/updated-php-windows-builds-for-brotli-security-fix/121601/1 "2026-10-27T06:36:29Z")

</div>

### Website URL

> **[PHP: News Archive - 2026](https://www.php.net/archive/2026.php?fbclid=IwZXh0bgNhZW0CMTEAcGRvZgNzcnRjBmFwcF9pZA8yNzUyNTQ2OTI1OTgyNzkAAR7fJYt8vMwONJX9c1s7c9W_zG5Rz8VTlxwneRmiECo9wiQKodhQGYqTq3R6OA_aem_ew4GMrf67n8gdIaRKnkCoQ)**
>
> PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

### Error Message

The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression.

In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.

The -1 suffix identifies a Windows package rebuild with updated dependencies. These builds use the same PHP source releases, and the PHP runtime versions remain unchanged.

### Other Information

Is there anything client can do about this?

---

<div class="post-metadata">

**Author:** ![Lemni](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/lemni/32/68303_2.png) [@Lemni](https://forum.infinityfree.com/u/Lemni)\
**Post date:** [October 27, 2026, 6:36am UTC](https://forum.infinityfree.com/t/updated-php-windows-builds-for-brotli-security-fix/121601/2 "2026-10-27T06:36:40Z")

</div>

_Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look._

I couldn’t find anything in our knowledge base or on the forum about this PHP announcement, so I can’t say whether it affects InfinityFree hosting or whether a client can do anything about it.

Is this about a site of yours on InfinityFree, for example one making cURL requests that show an error? If so, what’s the exact error text, and what’s the website address? The link you gave is the PHP site, not yours.

---

<div class="post-metadata">

**Author:** ![Meishin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/meishin/32/59902_2.png) [@Meishin](https://forum.infinityfree.com/u/Meishin)\
**Post date:** [October 27, 2026, 6:37am UTC](https://forum.infinityfree.com/t/updated-php-windows-builds-for-brotli-security-fix/121601/3 "2026-10-27T06:37:54Z")

</div>

Free hosting runs on Linux. There’s nothing to do.

---

<div class="post-metadata">

**Author:** ![Mr\_Craft](https://forum.infinityfree.com/letter_avatar/mr_craft/32/5_5575768a8748004e209b776fc1b2916d.png) [@Mr\_Craft](https://forum.infinityfree.com/u/Mr_Craft)\
**Post date:** [October 27, 2026, 6:39am UTC](https://forum.infinityfree.com/t/updated-php-windows-builds-for-brotli-security-fix/121601/4 "2026-10-27T06:39:26Z")

</div>

**Noted**