Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1080
_____________________________________________________________________

DATE                : 27/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows running PHP versions prior to 8.5.12-1,
                             8.4.27-1, 8.3.36-1, 8.2.35-1.

====================================================================
https://www.php.net/archive/2026.php#2026-10-26-1
_____________________________________________________________________
 
Updated PHP Windows builds for Brotli security fix

The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1,
8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which
fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli
decompression.

In PHP Windows builds, the vulnerable decoder can be reached through
the cURL extension when automatic HTTP response decompression is
enabled. This is disabled by default in cURL, but applications and
HTTP client libraries can enable it.

The -1 suffix identifies a Windows package rebuild with updated
dependencies. These builds use the same PHP source releases, and the
PHP runtime versions remain unchanged. 


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================