PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP updates Windows builds 8.2 through 8.5 to fix a Brotli flaw that could enable code execution through automatic cURL decompression.
More info