PHP Windows Builds HTTP2Shell Fix Explained: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 With Brotli 1.2.1

Image: Wikimedia Commons — the official PHP logo. PHP is a programming language, not a device, so the project logo identifies the platform; there is no product photograph for a software build update.

TL;DR — PHP Windows builds HTTP2Shell fix explained in one line: on 26 October 2026 PHP shipped rebuilt Windows packages — 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 — bundling Brotli 1.2.1 to close the critical decoder flaw CVE-2026-111497. If you run PHP on Windows, install the "-1" build for your branch; the runtime version number itself does not change.

📌 KEY HIGHLIGHTS

PHP announced the new Windows builds on 26 October 2026: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1.
Each build bundles Brotli 1.2.1, fixing the out-of-bounds write flaw CVE-2026-111497, known as HTTP2Shell (first called Node2Shell).
On Windows PHP the flaw is reachable through the cURL extension when automatic HTTP response decompression is on — a setting that is off by default.
The "-1" suffix means a Windows rebuild with updated dependencies; the PHP version itself is unchanged, so php -v alone will not show the fix.
PHP 8.2 reaches end of life on 31 December 2026 — its 8.2.35-1 build buys about two months, so plan a branch upgrade.

What happened?

PHP's Windows builds are rebuilt separately from the main releases, and on 26 October 2026 that rebuild picked up an urgent dependency fix. The new packages — PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 — replace the Brotli compression library they ship with version 1.2.1, closing CVE-2026-111497. Google rates the flaw 9.2 out of 10 on CVSS v4.0; Node.js, which disclosed the same bug in its own security release on 21 October, rates it high severity.

The flaw sits in Google's Brotli decoder: an out-of-bounds write, where code writes past the memory area it was meant to use. Depending on the setup, that can crash a program, expose memory contents, or let code run remotely without a login. Because Brotli is reused by so many products, the same CVE has now drawn fixes from Node.js, Python packages, .NET, FFmpeg, ClickHouse and Apache Arrow — and the name has widened with the scope, from Node2Shell to HTTP2Shell. It is one CVE, not a second flaw.

PHP Windows builds HTTP2Shell fix explained: the new builds

Match your installed branch to its new build — do not jump branches just to get the fix. The table below is the whole update:

PHP branch	New Windows build	What changed	Branch support ends
PHP 8.5	8.5.12-1	Brotli 1.2.1	31 Dec 2029 (security)
PHP 8.4	8.4.27-1	Brotli 1.2.1	31 Dec 2028 (security)
PHP 8.3	8.3.36-1	Brotli 1.2.1	31 Dec 2027 (security)
PHP 8.2	8.2.35-1	Brotli 1.2.1	31 Dec 2026 (end of life)

PHP 8.1 and older receive no project releases at all. The fixed upstream Brotli versions are 1.0.10, 1.1.1 and 1.2.1 — some vendors backport the fix into older releases, so a build can be safe even when its version number looks old.

php windows builds http2shell fix explained — server room

Illustrative image: a server room. Image: Wikimedia Commons / BalticServers.com. Windows PHP hosts, not the pictured hardware, are what need the new builds.

Who is actually at risk?

PHP's advisory explains the route: the vulnerable decoder is reached through the cURL extension when automatic HTTP response decompression is turned on. That setting is off by default in cURL, but applications and HTTP client libraries can enable it. A PHP setup is therefore most at risk when it decodes Brotli data from sources it does not trust.

Three traps catch upgraders. First, the version number does not change: 8.5.12 stays 8.5.12, so checking php -v will not tell you whether the "-1" rebuild is installed — check the build's download date or file hash instead. Second, PHP for Windows is a ZIP, not an installer: pick the same thread-safety type you already run (Thread Safe for Apache as a module, Non Thread Safe for IIS FastCGI or the command line) or extensions will fail to load. Third, package-manager feeds can lag behind php.net, so verify after upgrading and fall back to the ZIP if the version has not changed. Keep your existing php.ini and restart the web server after the swap.

This is a different flaw from the October 21 PHP2Shell pair (CVE-2026-109618 and CVE-2026-109619), which allowed remote code execution and was fixed in the base 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releases themselves. If you never installed those October 21 releases, you need them first — the "-1" rebuilds sit on top of them. TechByCountry covered the HTTP2Shell flaw's spread across the ecosystem on 25 October and Microsoft's .NET out-of-band fix earlier today; the PHP Windows builds are the next vendor step in the same incident.

Why it matters for World Tech readers

This is what a supply-chain flaw looks like in slow motion: one decoder bug, found by OpenAI's Codex Security team while probing its own sandbox, rippling through every runtime that bundles the library. Each vendor fixes it on its own clock — Node.js on 21 October, .NET on 25 October, PHP's Windows builds on 26 October — and each fix only helps the hosts that actually install it. The lesson from the whole HTTP2Shell episode is unglamorous but real: inventory every place a runtime runs, including bundled copies inside other products, because the version number on the box is not the whole story.

For teams that cannot patch right away, the holding advice is to keep untrusted Brotli input away from production systems until the rebuild is installed. And for anyone still on PHP 8.2, the calendar is the second deadline: security support ends 31 December 2026, so the 8.2.35-1 build is a bridge to 8.4 or 8.5, not a destination.

Should you care? ✅ Patch now if you run PHP on Windows. The fix is a rebuild, not a migration — same version, same extensions, same php.ini — so there is no reason to wait. If you run PHP only on Linux, your distribution's package is a separate track; check its security tracker rather than this build list.

How to update, step by step

1. Confirm your branch: run php -v and note the branch (8.5, 8.4, 8.3 or 8.2). 2. Download: from the php.net Windows downloads page, pick the ZIP for your branch, architecture (x64) and thread-safety type, matching what you already run. 3. Stop the server (or recycle the IIS application pool). 4. Back up your current PHP folder and php.ini. 5. Extract the new ZIP over the folder, keeping your php.ini. 6. Restart and confirm the server serves pages; if phpinfo() still shows the old build, the handler still points at the old folder. Winget, Chocolatey and Scoop users should verify after upgrading, since feeds can lag.

FAQs

What are the new PHP Windows builds?
PHP's 26 October 2026 Windows rebuilds — 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 — which bundle Brotli 1.2.1 to fix CVE-2026-111497. They are Windows-only; the PHP runtime versions themselves are unchanged from the 21 October releases.

What is HTTP2Shell (CVE-2026-111497)?
An out-of-bounds write in Google's Brotli decoder that can crash a program, expose memory, or allow remote code execution, depending on the setup. Researchers first called it Node2Shell when it surfaced in Node.js; as more products proved affected, the name widened to HTTP2Shell. It is a single CVE, not two flaws.

What does the "-1" in PHP 8.5.12-1 mean?
It marks a Windows rebuild with updated dependencies. The PHP version is the same 8.5.12, so php -v will not show the change — check the build itself, its download date or its file hash to confirm the rebuild is installed.

How do I check whether my Windows PHP is affected?
If you run PHP on Windows without the "-1" rebuild and your setup decodes Brotli data from untrusted sources — via cURL with automatic decompression enabled, for example — treat it as exposed and install the rebuild. Linux PHP from a distribution follows that distributor's security tracker, not this build list.

Is this the same as PHP2Shell?
No. PHP2Shell is the pair of critical PHP flaws CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. HTTP2Shell is the separate Brotli decoder flaw, fixed for Windows PHP only by the 26 October "-1" rebuilds on top of those releases.

Takeaway: Same version number, new build, real fix — Windows PHP hosts need the "-1" rebuilds, and PHP 8.2 hosts need an upgrade plan before 31 December. Check the build, not just the version.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

TechByCountry — Daily Tech News, Country by Country

Search This Blog