
Backported from 8.2.35

- Core:
  . Mitigated GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
    bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
    ndossche, Nicolas Grekas)

Backported from 8.2.34

- Filter:
  . Fixed GHSA-ch8v-r6jh-4vvr (FILTER_SANITIZE_ENCODED does not encode 0xFF).
    (Ilia Alshanetsky)

- FPM:
  . Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
    due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)

- MySQLnd:
  . Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
    protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)

- OpenSSL:
  . Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
    SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
  . Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
    php_openssl_matches_wildcard_name() on crafted server certificate wildcard
    CN). (CVE-2026-91767) (Jakub Zelenka)

- Phar:
  . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
    TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)

- SOAP:
  . Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
    cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
  . Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
    parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)

- Standard:
  . Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
    when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
  . Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
    wrapper redirects). (CVE-2026-91766) (Alexandre Daubois, Jakub Zelenka)
  . Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
    when following a redirect with an empty Location header). (CVE-2026-93682)
    (Ilia Alshanetsky, Jordi Kroon)

- Windows:
  . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
    file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)

Backported from 8.2.33

- Date:
  . Fixed leak on double DatePeriod::__construct() call. (ilutov)

- GD:
  . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)

- PGSQL:
  . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
    (CVE-2026-17543) (ilutov)

- Phar:
  . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
    (Jakub Zelenka)

Backported from 8.2.32

- OpenSSL:
  . Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in
    openssl_encrypt with AES-WRAP-PAD). (David Carlier)

Backported from 8.2.31

- FPM:
  . Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)
    (Jakub Zelenka)

- SOAP:
  . Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache
    Map). (CVE-2026-6722) (ilutov)
  . Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with
    SOAP_PERSISTENCE_SESSION). (CVE-2026-7261) (ilutov)
  . Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check).
    (CVE-2026-7262) (ilutov)

- Standard:
  . Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset).
    (CVE-2026-7568) (TimWolla)
  . Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h
    functions). (CVE-2026-7258) (ilutov)

Backported from 8.1.34

- Standard:
  . Fixed GHSA-www2-q4fc-65wf (Null byte termination in dns_get_record()).
    (ndossche)
  . Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()).
    (CVE-2025-14178) (ndossche)
  . Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize).
    (CVE-2025-14177) (ndossche)

Backported from 8.1.33

- PGSQL:
  . Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during
    escaping). (CVE-2025-1735) (Jakub Zelenka)

- SOAP:
  . Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension
    via Large XML Namespace Prefix). (CVE-2025-6491) (Lekssays, nielsdos)

- Standard:
  . Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames).
    (CVE-2025-1220) (Jakub Zelenka)

Backported from 8.1.32

- LibXML:
  . Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714). (nielsdos)
  . Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header
    when requesting a redirected resource). (CVE-2025-1219) (timwolla)

- Streams:
  . Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit
    basic auth header). (CVE-2025-1736) (Jakub Zelenka)
  . Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location
    to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)
  . Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers
    without colon). (CVE-2025-1734) (Jakub Zelenka)
  . Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not
    handle folded headers). (CVE-2025-1217) (Jakub Zelenka)

Backported from 8.1.31

- CLI:
  . Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
    Processing in CLI SAPI Interface). (nielsdos)

- LDAP:
  . Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
    (nielsdos)

- MySQLnd:
  . Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through
    heap buffer over-read). (CVE-2024-8929) (Jakub Zelenka)

- PDO DBLIB:
  . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing
    OOB writes). (CVE-2024-11236) (nielsdos)

- PDO Firebird:
  . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter
    causing OOB writes). (CVE-2024-11236) (nielsdos)

- Streams:
  . Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
    might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
  . Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
    convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)

Backported from 8.1.30

- CGI:
  . Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
    Vulnerability). (CVE-2024-8926) (nielsdos)
  . Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
    bypassable due to the environment variable collision). (CVE-2024-8927)
    (nielsdos)

- FPM:
  . Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered).
    (CVE-2024-9026) (Jakub Zelenka)

- SAPI:
  . Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
    (CVE-2024-8925) (Arnaud)

Backported from 8.1.29

- CGI:
  . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
    in PHP-CGI). (CVE-2024-4577) (nielsdos)

- Filter:
  . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL).
    (CVE-2024-5458) (nielsdos)

- Standard:
  . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874).
    (CVE-2024-5585) (nielsdos)

Backported from 8.1.28

- Standard:
  . Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to
    partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
  . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
    opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)
  . Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command
    parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)

Backported from 8.0.30

- Libxml:
  . Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading
    in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)

- Phar:
  . Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()).
    (CVE-2023-3824) (nielsdos)

Backported from 8.0.29

- Soap:
  . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
    bytes in HTTP Digest authentication for SOAP).
    (CVE-2023-3247) (nielsdos, timwolla)

Backported from 8.0.28

- Core:
  . Fixed bug #81744 (Password_verify() always return true with some hash).
    (CVE-2023-0567). (Tim Düsterhus)
  . Fixed bug #81746 (1-byte array overrun in common path resolve code).
    (CVE-2023-0568). (Niels Dossche)
  . Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
    request body). (CVE-2023-0662) (Jakub Zelenka)

Backported from 8.0.27

- PDO/SQLite:
  . Fixed bug #81740 (PDO::quote() may return unquoted string).
    (CVE-2022-31631) (cmb)

