- CVE-2026-92842: heap out-of-bounds read in the convert.* stream filters when the line-break-chars parameter contains a NUL byte (GHSA-88hq-2827-7pg6); the three ext/standard/filters.c constructors duplicated lbchars with the strlen-based pestrdup() while keeping the original lbchars_len, so every later use read past the truncated copy. Duplicate with pestrndup(lbchars, lbchars_len, ...) instead - CVE-2025-14181: heap buffer overflow in ext/soap get_http_body() on a chunked response (GHSA-cj93-vc83-wgqv); the "http_buf_size + buf_size + 1 < 0" guard relied on signed integer overflow, so a malicious SOAP endpoint could make the buffer be reallocated smaller than the data then read into it. Make the accumulator size_t and the chunk length unsigned, bound every growth step against a new SOAP_HTTP_BODY_MAX_LEN (the largest body an int out_size can carry), and apply the same checked add to the Connection: close branch and a checked allocation size to the redirect path - CVE-2026-6103: phar tar entry injection (GHSA-j3wh-g957-2m85); a crafted archive could leave phar_parse_tarfile() positioned on attacker-controlled data that was then read as a tar header. Parse the size field with a new checked phar_tar_size() that rejects octal overflow, trailing garbage and GNU base-256 encodings, refuse GNU long link records, bound the ././@LongLink name by the archive size, and skip the data blocks of every entry type that carries data rather than only '\0' and TAR_FILE - CVE-2026-91765: stack exhaustion from unbounded recursion in ext/soap (GHSA-rgrp-mwpx-f6rm) on deeply nested XML or on a chain of href references; soap_xmlParseMemory() sets XML_PARSE_HUGE so libxml2's own limit does not apply. Make cleanup_xml_node() and get_node_with_attribute_recursive_ex() iterative, reject documents deeper than SOAP_MAX_XML_DEPTH before the tree is used, and cap the decoder with a decode_depth counter in the soap globals that master_to_zval_int() checks and encode_reset_ns()/encode_finish() clear