On this page (6 sections)

The php.net conferences page announces the 21st Dutch PHP Conference, set for March 2027 in Amsterdam, along with a list of other PHP events. The same page text also carries a headline reading "Updated PHP Windows builds for Brotli security fix".

If you run PHP from official Windows builds, that headline is worth a look. If you only want conference dates, those are below. The page we reviewed gives no detail about the security fix itself, so this article separates what is confirmed from what is not.

What the php.net page confirms

According to the php.net conferences page, the Dutch PHP Conference 2027 runs from March 16 to March 19, 2027 in Amsterdam. The Call for Papers is open with a deadline of December 18th, and early bird tickets are on sale. The conference is split into a 2-day format, and a standard day ticket includes access to Webdevcon. The 4-day ticket adds workshop days and co-located conferences, including Appdevcon and the Dutch AI Conference.

The same page lists several other events:

  • PHPBenelux Conference 2027: Saturday January 23, 2027, Antwerp, Belgium, one-day event.
  • PHP Conference Ehime 2026: October 3, 2026, Ehime University Johoku Campus, Matsuyama City, Japan.
  • API Platform Conference 2026: September 17 and 18, 2026, Lille, France and online.
  • Forum PHP 2026: October 8 and 9, Paris area, France.
  • LonghornPHP 2026: tutorial day Thursday October 15 and main day Friday October 16, Austin, Texas.
  • International PHP Conference Munich 2026: October 26 to 30, 2026, Munich or online.
Some of the 2026 events above may already have taken place by the time you read this. Check each organizer's site for current details.

The Brotli security headline: what we know and do not know

The page text begins with the line "Updated PHP Windows builds for Brotli security fix". That is all the source says. It does not name a CVE, a CVSS score, affected or fixed PHP versions, a date for the fix, or whether anyone is exploiting the issue. Only one source covers this so far, and it is a conference listing page rather than a security advisory.

For that reason we are not stating which component is affected, how severe the problem is or which builds are fixed. Treat all of those as unconfirmed until you read the full php.net announcement. We also do not describe how PHP uses Brotli, because the source does not explain it.

Who should pay attention

The headline refers to updated PHP Windows builds, so the people most likely to care are those who run PHP from official Windows builds. Beyond that, the scope of impact is unconfirmed: the source does not say which setups are affected, so do not assume you are affected or safe based on this headline alone.

  • Anyone running PHP on Windows from the official builds should read the full notice and compare their build with the one it names.
  • If you package or redistribute PHP builds, check whether the notice applies to what you ship.
  • Operators on other platforms should follow their normal PHP update routine and check php.net for any statement about their platform.

How to check your exposure

These are read-only checks. The first prints your PHP version and build details. Run it in a command prompt or PowerShell on the Windows server and compare the version and build date with the php.net Windows downloads and release notes.

Show the installed PHP version and build info (Windows command prompt)Windows command
php -v

On Linux, a standard package query shows what your distribution has installed, which you can compare with your distribution's own security notices. This is the Debian and Ubuntu variant; it lists installed packages whose names contain php.

Show installed PHP packages and versions (Debian/Ubuntu)Shell
dpkg -l | grep -i php

This is the RHEL-family variant, which does the same on RHEL, Rocky and Alma.

Show installed PHP packages and versions (RHEL, Rocky, Alma)Shell
rpm -qa | grep -i php

What to do now

Caution. Replacing PHP builds on a live server usually means restarting the web server or other services that load PHP. Test on staging and pick a quiet window before you update production.

Monitoring afterwards

After any PHP update, confirm the version actually served by the site and watch error logs for startup or extension errors. A free security headers checker can confirm your response headers did not change unexpectedly, and Webforta Monitor can alert you to uptime, certificate and header changes after a maintenance window. For general upkeep habits, see our small business website security guide.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. PHP: PHP Conferences around the worldphp.net ·
  • PHP
  • Brotli
  • Windows
  • Conferences
  • Patch management