The third critical vulnerability in PHP has been found in five days, and the fix is already available.

PHP has released its second security update in five days to address a critical vulnerability identified as CVE-2026-111497. This flaw affects the Brotli compression library in Windows packages from versions 8.2 to 8.5, allowing attackers to access memory and execute malicious code. The new packages, versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, were released shortly after fixing another critical issue known as PHP2Shell, which posed risks of remote exploitation. The vulnerability affects 70% of systems and requires users to update to mitigate risks. PHP advises Windows users to download the updated versions, which retain the same version number in the command line. The vulnerability was discovered by OpenAI researchers, and there are currently no indications of it being exploited.