* SECURITY UPDATE: heap out-of-bounds read in convert.* stream filters when line-break-chars contains a NUL byte - debian/patches/php-7.4-CVE-2026-92842.patch: backport upstream commit b4e3397e in ext/standard/filters.c - duplicate lbchars with pestrndup(lbchars, lbchars_len) instead of the strlen-based pestrdup() in the base64-encode, quoted-printable-encode and quoted-printable-decode constructors. - CVE-2026-92842 * SECURITY UPDATE: heap buffer overflow in SoapClient chunked HTTP response body handling - debian/patches/php-7.4-CVE-2025-14181.patch: backport upstream commit b11bd1d9 in ext/soap/php_http.c - make the get_http_body() size accumulator size_t, bound each growth step against ZSTR_MAX_LEN and use zend_string_safe_realloc()/zend_string_safe_alloc(). - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection via invalid entry sizes and data-carrying entry types - debian/patches/php-7.4-CVE-2026-6103.patch: backport upstream commit 0994e2e8 in ext/phar/tar.c and ext/phar/phar_internal.h - reject tar sizes that are not valid octal or overflow, refuse GNU long link records, bound ././@LongLink names by the archive size and skip the data blocks of every entry type that carries data. - CVE-2026-6103 * SECURITY UPDATE: stack overflow through unbounded recursion in ext/soap XML parsing and decoding - debian/patches/php-7.4-CVE-2026-91765.patch: backport upstream commit 3655b79c in ext/soap/php_xml.c, php_encoding.c, php_soap.h and soap.c - iterative cleanup_xml_node() and get_node_with_attribute_recursive_ex(), a 2048-level nesting cap for libxml2 < 2.13 and a decode_depth counter in the soap module globals. - CVE-2026-91765