* SECURITY UPDATE: heap over-read in convert.* stream filters - debian/patches/php-7.2-CVE-2026-92842.patch: duplicate line-break-chars with pestrndup() so an embedded NUL byte no longer truncates the copy while the full length is kept, in ext/standard/filters.c (GHSA-88hq-2827-7pg6). - CVE-2026-92842 * SECURITY UPDATE: heap overflow in SOAP chunked HTTP response handling - debian/patches/php-7.2-CVE-2025-14181.patch: accumulate the body size in size_t, bound each growth step by ZSTR_MAX_LEN and use checked reallocation in get_http_body(), ext/soap/php_http.c (GHSA-cj93-vc83-wgqv). - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection - debian/patches/php-7.2-CVE-2026-6103.patch: reject unparsable or overflowing tar entry sizes and GNU long-link records, bound ././@LongLink names by the archive size and skip the data of every entry type that carries data, in ext/phar/tar.c and ext/phar/phar_internal.h (GHSA-j3wh-g957-2m85). - CVE-2026-6103 * SECURITY UPDATE: unbounded recursion in ext/soap XML handling - debian/patches/php-7.2-CVE-2026-91765.patch: make XML cleanup and href lookup iterative, reject over-deep documents on libxml2 < 2.13 and cap the decoder nesting depth, in ext/soap/php_xml.c, php_encoding.c, php_soap.h and soap.c (GHSA-rgrp-mwpx-f6rm). - CVE-2026-91765