Back to Changelog
PHP 8.5
v8.5.12.1
Security rebuild of PHP 8.5.12: the bundled Brotli library is fixed (CVE-2026-111497) along with six more bundled libraries
Improvements
2- PHP itself is unchanged at 8.5.12. Only the libraries the package carries were rebuilt, so extensions, settings and site behaviour stay the same.
- The package was checked on all nine supported operating systems, and the update was applied on test servers from the published version before release.
Security Fixes
2- The Brotli library this package carries is rebuilt with the fix for CVE-2026-111497, an out-of-bounds write in the Brotli decoder (CVSS 9.2). PHP reads Brotli data wherever a site decompresses a Brotli response, so a crafted response could corrupt memory in the PHP process.
- Six more libraries inside the package also carry their vendor security fixes: curl, libaom, libevent, xz, nghttp2 and PCRE2.