ZendPHP October 2026 Windows Update

October 26, 2026

Windows Package Updates

The ZendPHP Windows packages for all currently supported PHP versions (7.2 through 8.5) have been updated with refreshed dependency libraries. The PHP runtime versions are unchanged; only the bundled libraries were updated.

Brotli updated to v1.2.1, fixing CVE-2026-111497 (google/brotli v1.2.1), an out-of-bounds write vulnerability in Brotli decompression. In PHP Windows builds, the vulnerable decoder can be reached through the curl extension when automatic HTTP response decompression is enabled. For the PHP community notice, see Updated PHP Windows builds for Brotli security fix.
libssh2 updated to v1.11.1.

We recommend that all Windows users upgrade to the latest ZendPHP package for their PHP version.