PHP has rebuilt its official Windows binary packages to patch CVE-2026-111497, a memory corruption vulnerability in the bundled Brotli compression library that could lead to code execution.
PHP maintainers have issued mitigation advice for a new remote code execution vulnerability, CVE-2026-115560, which requires a rare combination of configuration settings to exploit.
Security researchers have confirmed active exploitation of PHP2Shell vulnerabilities, allowing remote code execution. A second, unpatched vulnerability has also been identified affecting certain configurations.
