* SECURITY UPDATE: heap over-read in convert.* stream filters - debian/patches/php-8.1-CVE-2026-92842.patch: duplicate line-break-chars with pestrndup() so an embedded NUL byte no longer truncates the copy while lbchars_len keeps the full length in ext/standard/filters.c. - CVE-2026-92842 * SECURITY UPDATE: heap overflow reading chunked SOAP HTTP responses - debian/patches/php-8.1-CVE-2025-14181.patch: use a size_t accumulator and unsigned chunk size, bound every growth step against ZSTR_MAX_LEN and use checked allocations in get_http_body(), and use a checked allocation when building the relative redirect path in make_http_soap_request() in ext/soap/php_http.c. - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection - debian/patches/php-8.1-CVE-2026-6103.patch: reject tar entry sizes that cannot be parsed or represented, refuse GNU long link records and skip the data blocks of every entry type that carries data in ext/phar/tar.c and ext/phar/phar_internal.h. - CVE-2026-6103 * SECURITY UPDATE: unbounded recursion in SOAP XML parsing and decoding - debian/patches/php-8.1-CVE-2026-91765.patch: make node cleanup and attribute lookup iterative, reject over-deep documents and cap the decoder nesting depth in ext/soap/php_xml.c, ext/soap/php_encoding.c, ext/soap/php_soap.h and ext/soap/soap.c. - CVE-2026-91765