Author: Shivam Mathur (shivammathur)
Date: 2026-10-26T18:43:58+05:30
Commit:
https://github.com/php/web-php/commit/f1cc5dae980d8c03bb5ca58335af08797e7f4c6e
Raw diff:
https://github.com/php/web-php/commit/f1cc5dae980d8c03bb5ca58335af08797e7f4c6e.diff
Announce Windows rebuilds with Brotli security fix
Changed paths:
A public/archive/entries/2026-10-26-1.xml
M public/archive/archive.xml
Diff:
diff --git a/public/archive/archive.xml b/public/archive/archive.xml
index e5b1bb6ab6..77145dfdae 100644
--- a/public/archive/archive.xml
+++ b/public/archive/archive.xml
@@ -9,6 +9,7 @@
<uri>http://php.net/contact</uri>
<email>[email protected]</email>
</author>
+ <xi:include href="entries/2026-10-26-1.xml"/>
<xi:include href="entries/2026-10-23-1.xml"/>
<xi:include href="entries/2026-10-21-5.xml"/>
<xi:include href="entries/2026-10-21-6.xml"/>
diff --git a/public/archive/entries/2026-10-26-1.xml
b/public/archive/entries/2026-10-26-1.xml
new file mode 100644
index 0000000000..828a3a67fb
--- /dev/null
+++ b/public/archive/entries/2026-10-26-1.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="utf-8"?>
+<entry xmlns="http://www.w3.org/2005/Atom";>
+ <title>Updated PHP Windows builds for Brotli security fix</title>
+ <id>https://www.php.net/archive/2026.php#2026-10-26-1</id>
+ <published>2026-10-26T11:57:45+00:00</published>
+ <updated>2026-10-26T11:57:45+00:00</updated>
+ <link href="https://www.php.net/index.php#2026-10-26-1"; rel="alternate"
type="text/html"/>
+ <link href="https://www.php.net/archive/2026.php#2026-10-26-1"; rel="via"
type="text/html"/>
+ <category term="frontpage" label="PHP.net frontpage news"/>
+ <content type="xhtml">
+ <div xmlns="http://www.w3.org/1999/xhtml";>
+ <p>
+ The PHP team announces updated Windows builds:
+ <strong>PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1</strong>.
+ These builds include Brotli 1.2.1, which fixes
+ <a
href="https://github.com/google/brotli/releases/tag/v1.2.1";>CVE-2026-111497</a>,
+ an out-of-bounds write vulnerability in Brotli decompression.
+ </p>
+ <p>
+ In PHP Windows builds, the vulnerable decoder can be reached through
the
+ cURL extension when automatic HTTP response decompression is enabled.
+ This is disabled by default in cURL, but applications and HTTP client
+ libraries can enable it.
+ </p>
+ <p>
+ The <code>-1</code> suffix identifies a Windows package rebuild with
updated
+ dependencies. These builds use the same PHP source releases, and the
PHP
+ runtime versions remain unchanged.
+ </p>
+ <p>
+ The updated packages are available on the
+ <a href="https://www.php.net/downloads.php?os=windows";>downloads
page</a>.
+ </p>
+ </div>
+ </content>
+</entry>
