- CVE-2026-92842: the convert.base64-encode and convert.quoted-printable-* filters duplicated line-break-chars with the strlen-based pestrdup() but kept the full length, so a NUL in the option made the filter read past the allocation; duplicate it with pestrndup() - CVE-2025-14181: SoapClient summed chunked response sizes in an int, so a crafted chunk size wrapped the accumulator and undersized the body buffer; use a size_t accumulator, bound every growth step against ZSTR_MAX_LEN and grow with zend_string_safe_realloc() - CVE-2026-6103: PharData accepted tar entry sizes that overflow or do not parse and did not skip the data of non-regular entry types, so attacker data was parsed as a tar header; validate the size, refuse GNU long link records and skip the data of every type that carries data - CVE-2026-91765: ext/soap recursed without a limit while cleaning up, searching and decoding XML, so a deeply nested or self-referencing document exhausted the C stack; cap the decode depth and make the tree walks iterative