* SECURITY UPDATE: heap overread in the convert.* stream filters when line-break-chars contains a NUL byte - debian/patches/php-7.3-CVE-2026-92842.patch: backport upstream commit b4e3397ec8 in ext/standard/filters.c - duplicate lbchars with pestrndup(lbchars, lbchars_len) instead of the strlen-based pestrdup() in the base64-encode, quoted-printable-encode and quoted-printable-decode constructors. - CVE-2026-92842 * SECURITY UPDATE: SoapClient heap overflow via an oversized chunked HTTP response - debian/patches/php-7.3-CVE-2025-14181.patch: backport upstream commit b11bd1d939 in ext/soap/php_http.c - size_t body accumulator, unsigned chunk size, every growth step bounded against ZSTR_MAX_LEN and the chunked realloc done with zend_string_safe_realloc(). Adapted to the 7.3 int len_size counter and the 7.3 test server helper. - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection via unchecked entry size and data-carrying type flags - debian/patches/php-7.3-CVE-2026-6103.patch: backport upstream commit 0994e2e887 in ext/phar/tar.c and ext/phar/phar_internal.h - validate the octal entry size, refuse GNU long link records and over-long ././@LongLink names, and skip the data blocks of every entry type that carries data. zend_bool instead of C99 bool. - CVE-2026-6103 * SECURITY UPDATE: stack exhaustion via unbounded recursion in ext/soap XML parsing and decoding - debian/patches/php-7.3-CVE-2026-91765.patch: backport upstream commit 3655b79c7b in ext/soap/php_xml.c, php_encoding.c, php_soap.h and soap.c - cap decode depth with a decode_depth soap global, make cleanup_xml_node() and get_node_with_attribute_recursive_ex() iterative, and reject documents nested deeper than 2048 on libxml2 older than 2.13. - CVE-2026-91765