The fixes came out on 21 October. Five days later CISA put the two flaws in its catalog of actively exploited vulnerabilities, with a 29 October deadline for US federal agencies. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and we wrote about them then. Who is using the flaws and how, CISA's entry does not say.
Fact
The facts: on 26 October 2026 CISA added CVE-2026-109619 ("PHP Stale Internal Request-State Vulnerability") and CVE-2026-109618 ("PHP Memory Corruption Vulnerability") to its Known Exploited Vulnerabilities (KEV) catalog. The deadline in the entry is 29 October 2026. The same day PHP announced updated Windows builds: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1, which, according to PHP, fixes CVE-2026-111497, an out-of-bounds write in Brotli decompression. In PHP Windows builds the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. In cURL it is disabled by default, but applications and HTTP client libraries can enable it. PHP says the builds use the same source releases and the PHP runtime versions remain unchanged.
The second piece of news is for Windows, and it is quieter. There, besides the PHP version, there is one more number: the package's. 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 are rebuilt packages with updated dependencies. The PHP versions themselves are the same.
The catalog does not ask whether you heard about the flaw. It asks which version you run.
The reason is Brotli, a compression library the Windows builds carry with them. So the PHP version does not protect you here. The flaw is in the decoder, and PHP reaches it through cURL, only if automatic decompression is enabled. By default it is not. But the libraries that make HTTP requests from your application can switch it on for you. Whether CVE-2026-111497 is being used in attacks, PHP does not say.
On Windows, you look at the package name: it should end in -1, for example 8.5.12-1. Without it, the Brotli inside predates the fix.
Sources
CISA KEV (CVE-2026-109618, CVE-2026-109619), Known Exploited Vulnerabilities catalog, 26.10.2026CISA BOD 26-04 (Prioritizing Security Updates Based on Risk), directive for federal agencies, 10.06.2026PHP Windows builds (CVE-2026-111497), updated Windows builds with Brotli 1.2.1, 26.10.2026The visual is generated code-art, no third-party images.