https://www.live-feeds.com/feed/php-issues-second-windows-security-update-in-five-days-to-fix-brotli-code-execution-flawContinuously updated, source-cited coverage. https://www.live-feeds.com/feed/php-issues-second-windows-security-update-in-five-days-to-fix-brotli-code-execution-flawhttps://www.live-feeds.com/feed/php-issues-second-windows-security-update-in-five-days-to-fix-brotli-code-execution-flaw#u163117Fri, 30 Oct 2026 07:46:31 +0000PHP has deployed emergency Windows packages for versions 8.2 through 8.5 to address CVE-2026-111497, a critical out-of-bounds write memory-corruption vulnerability inside the bundled Brotli compression library. This security flaw can allow remote code execution when an application or HTTP client library activates automatic decompression within the cURL extension, although cURL leaves this setting off by default. The newly released packages are numbered 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. These builds incorporate Brotli version 1.2.1 and preserve prior fixes introduced just five days ea