* SECURITY UPDATE: heap out-of-bounds read in the convert.* stream filters when the "line-break-chars" parameter contains a NUL byte (GHSA-88hq-2827-7pg6) - debian/patches/php-5.3-CVE-2026-92842.patch: the base64-encode, quoted-printable-encode and quoted-printable-decode constructors in ext/standard/filters.c duplicated lbchars with the strlen-based pestrdup(), which truncates at the first NUL, while inst->lbchars_len kept the original length, so every later use copied lbchars_len bytes out of the shorter allocation; duplicate with pestrndup(lbchars, lbchars_len, persistent) instead - CVE-2026-92842 * SECURITY UPDATE: ext/soap heap buffer overflow when a SOAP peer sends a chunked response (GHSA-cj93-vc83-wgqv) - debian/patches/php-5.3-CVE-2025-14181.patch: get_http_body() in ext/soap/php_http.c accumulated the body length in an int and guarded the growth with "http_buf_size + buf_size + 1 < 0", which relies on signed integer overflow, so the buffer could be reallocated smaller than the data subsequently read into it; make the accumulator size_t and the chunk length unsigned, bound every growth step against a new SOAP_HTTP_BODY_MAX_LEN before the addition, add the same checked add to the unbounded "Connection: close" branch and use safe_emalloc() for the redirect path's allocation size - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection - a crafted tar archive could make the parser read attacker-controlled payload bytes as a tar header (GHSA-j3wh-g957-2m85) - debian/patches/php-5.3-CVE-2026-6103.patch: phar_parse_tarfile() in ext/phar/tar.c sized entries with phar_tar_number(), which wraps on octal overflow, ignores trailing garbage and reads a GNU base-256 field as 0, and it only skipped the data blocks of typeflag '\0' and TAR_FILE; parse the size with a new checked phar_tar_size(), refuse GNU long link records, bound the ././@LongLink name by the archive size, and skip the data of every type that carries data via a new phar_tar_type_has_data() - CVE-2026-6103 * SECURITY UPDATE: ext/soap stack exhaustion (unbounded recursion) on deeply nested XML or on a chain of href references (GHSA-rgrp-mwpx-f6rm) - debian/patches/php-5.3-CVE-2026-91765.patch: cleanup_xml_node() and get_node_with_attribute_recursive_ex() in ext/soap/php_xml.c recursed once per level of nesting and master_to_zval_int() in ext/soap/php_encoding.c re-entered itself through href resolution, with no depth limit in any of them and XML_PARSE_HUGE disabling libxml2's own; make both tree walks iterative, reject documents deeper than SOAP_MAX_XML_DEPTH in soap_xmlParseFile()/soap_xmlParseMemory(), and cap the decoder with a decode_depth counter added to the soap module globals, checked in master_to_zval_int() and cleared by encode_reset_ns()/encode_finish() - CVE-2026-91765