PHP has shipped a second emergency Windows build in less than a week, this time patching CVE-2026-111497, a memory-corruption bug inside the Brotli compression code it bundles for versions 8.2 through 8.5. The flaw surfaces when the cURL extension automatically decompresses an HTTP response, a setting that is off by default but enabled on some configurations. The fix underscores how one shared compression library is now driving urgent patches across several unrelated projects this week.
// source: thehackernews.com ↗