PHP Windows Brotli Update: Same Runtime, Rebuilt Package

A new Windows PHP package appears, yet its interpreter reports the same PHP version as yesterday. That can be a real security update. This time the package updates Brotli, a compression library that can be used to unpack data received over the network. It comes with the distribution, so it can need patching even when the PHP interpreter's version stays the same.

The PHP announcement dated 26 October 2026 lists Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1 for CVE-2026-111497. The -1 identifies a package rebuild, not a new PHP language version.

Why php -v is not the whole check

A PHP distribution contains extensions and supporting libraries as well as its interpreter. A vendor can rebuild the same source release with updated dependencies. The runtime's version string alone therefore cannot establish whether this particular package update has been installed.

Check the complete archive name, revision and SHA-256 on the official download page. Then establish which installation the website actually uses. A patched archive in a downloads folder says nothing about the executable selected by IIS or Apache. The distinction between web and shell measurements in the runtime-path guide applies here too, though Windows administration steps differ from cPanel.

Where Brotli enters the request path

The issue concerns an out-of-bounds write in Brotli decompression; the upstream Brotli release record documents the patched component. In the affected PHP Windows bundle, the decoder can be reached when the cURL extension automatically decompresses HTTP responses.

libcurl leaves automatic decompression disabled by default. Application code or an HTTP client library can enable it. Searching only for the word Brotli in your own application is consequently not a complete exposure assessment. Inspect the client library's effective request options too.

The libcurl encoding-option reference explains the relationship between response decoding and the requested encodings. An empty encoding string can request all encodings supported by the build. Manually adding an Accept-Encoding header is not, by itself, the same as enabling automatic decoding.

Inspect the loaded library

Use this in an authorized test environment with the relevant PHP executable:

<?php
header('Content-Type: text/plain; charset=utf-8');
echo 'PHP: ', PHP_VERSION, PHP_EOL;
if (!extension_loaded('curl')) {
    echo 'cURL extension is not loaded', PHP_EOL;
    exit;
}
$info = curl_version();
echo 'libcurl: ', $info['version'] ?? 'unknown', PHP_EOL;
echo 'Brotli: ', $info['brotli_version'] ?? 'not reported', PHP_EOL;

Available fields depend on the build; a missing field is not proof of safety. Brotli 1.2.1 is expected in the new official package. For a different vendor's build, verify the vendor's fix rather than applying a Windows package revision as a universal rule for Linux distributions.

Replace a package, not a random collection of DLLs

Back up the existing installation and configuration. Match the archive's x64/x86 architecture and TS/NTS type to the web integration. TS means thread-safe and is intended for multithreaded web-server modules; NTS means non-thread-safe and is used with separate-process integrations such as FastCGI. Do not switch types by guesswork. Extracting into a separate directory helps avoid mixing old and new library files. Review the configuration and third-party extensions against the destination package before switching.

Use the supported procedure to replace the relevant IIS application-pool or Apache/PHP processes. That can affect availability, so plan the change first. Opening a new shell does not replace web workers. Recheck PHP and Brotli from the same website context, then exercise normal API and compressed-response workflows. Running an exploit is unnecessary.

This is not another name for PHP2Shell. It involves a different component and fix. Complete the application checks after installing the rebuilt package; an unchanged PHP version string does not necessarily mean the update failed.

Note: Remove the diagnostic file after the check.