PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP maintainers have released a second Windows security Update in just five days, this time addressing a Brotli Flaw that could allow code execution through automatic cURL decompression. The updated builds cover PHP 8.2 through 8.5 on Windows, and administrators running affected versions are being urged to review their deployments without delay.

The quick succession of patches has drawn attention across the developer and security communities. While rapid fixes are generally a good sign of an active maintenance team, two Windows-specific updates in under a week raise practical questions about the reliability of the bundled libraries shipped with official binaries.

Note: the details below are based on the information in the summary provided. Specific technical identifiers, such as CVE numbers and exact version numbers, should be confirmed against the official PHP release announcements before you act on them.

What the Latest PHP Windows Update Actually Fixes

The update targets a Vulnerability in Brotli, a widely used compression library. Brotli is bundled with the Windows builds of PHP as part of its dependencies, which means a flaw in the library can flow directly into PHP environments on that platform.

According to the description, the flaw could enable code execution through automatic cURL decompression. In practice, this means that when PHP fetches remote content and cURL automatically decompresses a Brotli-encoded response, a malicious payload could trigger the bug.

The fix is delivered through refreshed Windows builds rather than changes to PHP's core language code. This distinction matters because Linux and other platforms typically rely on system-provided libraries, which are patched through their own distribution channels.

Which PHP Versions Are Affected by This Flaw

The updated builds span PHP 8.2, 8.3, 8.4, and 8.5 on Windows. That covers both older branches still receiving security support and newer releases, so a large portion of active Windows deployments may be in scope.

Administrators running PHP 8.1 or earlier should check their support status. Versions that no longer receive security updates will not get fixes, and teams on those branches should plan an upgrade to a supported release.

It is also worth checking how PHP was installed. Those who use the official Windows binaries from the PHP project need to download the new builds, while those who use bundled stacks such as local development packages must wait for those vendors to ship updated components.

How Automatic cURL Decompression Creates Attack Risk

cURL is one of the most commonly used tools in PHP applications for making HTTP requests, from calling APIs to fetching webhooks and third-party feeds. When configured to accept encoded responses, it can automatically decompress data before handing it back to the application.

That convenience becomes a risk when the decompression library has a memory safety problem. An attacker who controls or compromises a remote server could return a specially crafted Brotli response and attempt to exploit the weakness on the client side.

This makes the attack surface broader than it first appears. Any PHP application on Windows that connects to untrusted or user-supplied URLs, such as link previewers, importers, or proxy features, could be exposed if it uses affected builds.

Why Two Security Updates in Five Days Matter

Shipping two Windows security releases within five days is unusual. It suggests that issues in bundled dependencies were identified in quick succession, or that the first update did not fully resolve the exposure.

For operations teams, the cadence creates real workload. Each update requires testing, staging, and deployment, and repeating that cycle in a single week can strain smaller teams with limited maintenance windows.

Even so, the faster response is preferable to leaving a known code execution risk open. Teams should treat the newer build as the one to target, rather than stopping at the earlier release.

Steps Administrators Should Take Right Now

The first step is to inventory every Windows server and workstation running PHP 8.2 through 8.5. Record the exact build versions so you can verify which machines still need updates.

Next, download the latest builds from the official PHP for Windows site, test them against your applications in a staging environment, and then roll them out to production. Verify checksums and confirm that extensions such as cURL load correctly after the swap.

Where immediate patching is not possible, consider temporary mitigations. Restricting outbound requests to trusted hosts and avoiding automatic decoding of untrusted responses can reduce exposure until the update is applied.

The Broader Risk of Bundled Library Vulnerabilities

This incident highlights a recurring challenge in software supply chains. Language runtimes depend on many third-party libraries, and a vulnerability in any one of them can become a vulnerability in every product that ships it.

Windows builds are particularly sensitive because they bundle dependencies rather than relying on a system package manager. As a result, the PHP project must track upstream fixes and republish binaries whenever a bundled component is patched.

Organizations can lessen the burden by maintaining a software bill of materials. Knowing which libraries ship inside your runtime makes it far easier to respond when a flaw like this one is disclosed.

What Developers Can Do to Harden Applications

Beyond patching, developers should review how their applications use cURL. Validate and allowlist destination URLs, set sensible timeouts, and limit response sizes so that malicious servers have less room to cause harm.

It is also wise to run PHP processes with the least privilege possible. If an exploit were to succeed, a restricted service account would limit what an attacker could access on the host.

Finally, add monitoring for unusual process behavior and unexpected outbound connections. Early detection can turn a potential compromise into a contained incident.

Looking Ahead for PHP Security on Windows

The back-to-back releases are a reminder that patching is an ongoing discipline rather than a one-time task. Subscribing to the PHP security announcements and release feeds helps ensure that important fixes do not go unnoticed.

As more details emerge, including any public advisories or proof-of-concept research, the urgency for unpatched systems will likely grow. Updating now is the safest course for anyone running the affected Windows builds.

We will continue to follow this story and share updates as the PHP project and the wider security community provide more information.

If you have any questions, please don't hesitate to Contact Us