Tuxcare Errata System 0.0.1 5.10 2026-05-22T16:51:26 Debian 11 * ALTPHP-2031: write ioncube ext at the beginning of the default.ini conf Important TuxCare License Agreement CVE-2024-11235 Debian 11 * ALTPHP-2031: write ioncube ext at the beginning of the default.ini conf Important TuxCare License Agreement CVE-2024-11235 Debian 11 * Security fixes - CVE-2025-1736: verify CR during header check to prevent some misbehavior Low TuxCare License Agreement CVE-2025-1736 Debian 11 * Security fixes - CVE-2025-1736: verify CR during header check to prevent some misbehavior Important TuxCare License Agreement CVE-2024-11235 Debian 11 * Security fixes - CVE-2025-1736: verify CR during header check to prevent some misbehavior Low TuxCare License Agreement CVE-2025-1736 Debian 11 * Security fixes - CVE-2017-8923: fix integer overflow when concatenating strings - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl - CVE-2017-9119: handle memory limit error during string reallocation correctly - CVE-2017-9120: Integer overflow in mysqli_real_escape_string() Critical TuxCare License Agreement CVE-2017-9119 CVE-2017-9120 CVE-2017-8923 CVE-2017-9118 Debian 11 * ALTPHP-2068: Fixed opcache segfault on Ubuntu 22.04. Moderate TuxCare License Agreement CVE-2020-7071 Debian 11 * Security fixes - CVE-2019-9022: fix DNS response parsing Important TuxCare License Agreement CVE-2019-9022 Debian 11 * Security fixes - CVE-2019-9022: fix DNS response parsing Important TuxCare License Agreement CVE-2019-9022 Debian 11 * Security fixes - CVE-2019-11045: fix bug #78863 - DirectoryIterator class silently truncates after a nullbyte - CVE-2019-11043: fix bug #78599 - env_path_info underflow can lead to RCE - CVE-2019-9675: fix bug #77586 - phar_tar_writeheaders_int() buffer overflow - CVE-2019-9638, CVE-2019-9639: fix bug #77563 - uninitialized read in exif_process_IFD_in_MAKERNOTE - CVE-2019-9637: fix bug #77630 - safer rename() procedure Critical TuxCare License Agreement CVE-2019-11043 CVE-2019-9675 CVE-2019-9639 CVE-2019-9638 CVE-2019-9637 CVE-2019-11045 Debian 11 * Security fixes - CVE-2019-9023: fix issues with encoding length Critical TuxCare License Agreement CVE-2019-11045 CVE-2019-9023 CVE-2019-11043 Debian 11 * Security fixes - CVE-2019-11045: fix bug #78863 - DirectoryIterator class silently truncates after a nullbyte Moderate TuxCare License Agreement CVE-2019-11045 Debian 11 * Security fixes - CVE-2019-11041: fix bug #78222 -heap-buffer-overflow on exif_scan_thumbnail Important TuxCare License Agreement CVE-2019-11041 Debian 11 * Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 Debian 11 * Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-1220 CVE-2025-6491 Debian 11 * Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 Debian 11 * Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 Debian 11 * Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 Debian 11 * Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 Debian 11 * Security fixes - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix - CVE-2025-1220: fix null byte termination in hostnames Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 Debian 11 * Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 Debian 11 * Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 Debian 11 * Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 Debian 11 * Security fixes - CVE-2019-11042: heap-buffer-overflow on exif_process_user_comment Important TuxCare License Agreement CVE-2019-11042 Debian 11 * ALTPHP-2263: update to 8.2.30. Important TuxCare License Agreement CVE-2025-14177 CVE-2025-14178 CVE-2025-14180 Debian 11 * ALTPHP-2262: update to 8.1.34. Important TuxCare License Agreement CVE-2025-14178 CVE-2025-14180 CVE-2025-14177 Debian 11 * Security fixes - CVE-2025-14178: fix integer overflow in array_merge Important TuxCare License Agreement CVE-2025-14178 Debian 11 * Security fixes - CVE-2025-14178: fix integer overflow in array_merge Important TuxCare License Agreement CVE-2025-14178 Debian 11 * Security fixes - CVE-2025-14178: fix integer overflow in array_merge Important TuxCare License Agreement CVE-2025-14178 Debian 11 * Security fixes - CVE-2025-14178: fix integer overflow in array_merge Important TuxCare License Agreement CVE-2025-14178 Debian 11 * ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values for CageFS per-domain isolation Moderate TuxCare License Agreement CVE-2024-2756 CVE-2022-31631 CVE-2024-3096 Debian 11 * ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values for CageFS per-domain isolation Moderate TuxCare License Agreement CVE-2024-2756 CVE-2022-31631 CVE-2024-3096 Debian 11 * ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values for CageFS per-domain isolation Moderate TuxCare License Agreement CVE-2024-2756 CVE-2022-31631 CVE-2024-3096 Debian 11 * ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values for CageFS per-domain isolation Moderate TuxCare License Agreement CVE-2024-2756 CVE-2022-31631 CVE-2024-3096 Debian 11 * ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values for CageFS per-domain isolation Moderate TuxCare License Agreement CVE-2024-2756 CVE-2022-31631 CVE-2024-3096 Debian 11 * ALTPHP-2416: Update to 8.2.31 version Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7259 CVE-2025-14179 CVE-2026-7258 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-8.1-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor to ZVAL_PTR_DTOR. - CVE-2026-6722 * SECURITY UPDATE: pdo_firebird SQL injection via NUL bytes in quoted strings - debian/patches/php-8.1-CVE-2025-14179.patch: backport upstream commit 3f40b65323 in ext/pdo_firebird/firebird_driver.c — replace strncat/strncpy/strcpy in preprocess() with memcpy plus explicit length tracking. - CVE-2025-14179 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-8.1-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri - debian/patches/php-8.1-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc->request_uri with php_escape_html_entities_ex() / php_json_encode_string() and fix the broken "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise- AND of two flag constants evaluates to 0). Applies with line offsets only against PHP 8.1.34. - CVE-2026-6735 * SECURITY UPDATE: mbstring NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() - debian/patches/php-8.1-CVE-2026-7259.patch: backport upstream commit 79a054eae0 in ext/mbstring/php_mbregex.c — resolve the mbfl encoding before storing it in MBREX(current_mbctype_mbfl_encoding) and return FAILURE if NULL (encodings supported by Oniguruma but not mbfl such as iso-8859-11, UJIS, KOI8-R). - CVE-2026-7259 * SECURITY UPDATE: soap SoapServer use-after-free after header parsing failure when SOAP_PERSISTENCE_SESSION is set - debian/patches/php-8.1-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj) call sites in PHP_METHOD(SoapServer, handle) with "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)". Adapted to 8.1's fault path (extra zend_string_release(fn_name) before each dtor). - CVE-2026-7261 * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input - debian/patches/php-8.1-CVE-2026-7568.patch: backport upstream commit 47def8ce1d in ext/standard/metaphone.c — retype w_idx and Lookahead's how_far/idx from int to size_t to avoid signed overflow while walking strings larger than 2 GB on 64-bit builds. - CVE-2026-7568 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7259 CVE-2025-14179 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-8.0-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor to ZVAL_PTR_DTOR. - CVE-2026-6722 * SECURITY UPDATE: pdo_firebird SQL injection via NUL bytes in quoted strings - debian/patches/php-8.0-CVE-2025-14179.patch: backport upstream commit 3f40b65323 in ext/pdo_firebird/firebird_driver.c — replace strncat/strncpy/strcpy in preprocess() and the quoter with memcpy plus explicit length tracking. Adapted to the 8.0 (const char*, size_t) preprocess and quoter signatures. - debian/patches/php-8.0-firebird-static-inline-classes.patch: build fix required for the CVE-2025-14179 backport to be loadable on Debian. Upstream PHP-8.0.30 declares the pdo_firebird tokenizer helper as `inline char classes(char idx)` without `static`. C99 inline semantics require an external definition when the function is not inlined; nothing in PHP provides one. The Debian build's CFLAGS lacks `-O*` (falls back to gcc's `-O0`), so classes() is emitted as an undefined external reference, and pdo_firebird.so fails to load at runtime with "symbol lookup error: undefined symbol: classes". - CVE-2025-14179 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-8.0-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri - debian/patches/php-8.0-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc->request_uri with php_escape_html_entities_ex() and fix the broken "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise-AND of two flag constants evaluates to 0). Adapted to 8.0's single-bool `encode` model (8.0's JSON output branch already writes raw strings; this backport only addresses the HTML/XML XSS the CVE describes). - CVE-2026-6735 * SECURITY UPDATE: mbstring NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() - debian/patches/php-8.0-CVE-2026-7259.patch: backport upstream commit 79a054eae0 in ext/mbstring/php_mbregex.c — resolve the mbfl encoding before storing it in MBREX(current_mbctype_mbfl_encoding) and return FAILURE if NULL (encodings supported by Oniguruma but not mbfl such as iso-8859-11, UJIS, KOI8-R). - CVE-2026-7259 * SECURITY UPDATE: soap SoapServer use-after-free after header parsing failure when SOAP_PERSISTENCE_SESSION is set - debian/patches/php-8.0-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj) call sites in PHP_METHOD(SoapServer, handle) with "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)". Adapted to 8.0's fault path (extra efree(fn_name) before each dtor). - CVE-2026-7261 * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input - debian/patches/php-8.0-CVE-2026-7568.patch: backport upstream commit 47def8ce1d in ext/standard/metaphone.c — retype w_idx and Lookahead's how_far/idx from int to size_t to avoid signed overflow while walking strings larger than 2 GB on 64-bit builds. - CVE-2026-7568 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7259 CVE-2025-14179 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-5.6-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — adapt addref/dtor changes to pre-PHP7 zval** SOAP API. - Note: the 5.6 backport applies the addref half of the upstream fix only; the matching ref_map destructor change (NULL -> ZVAL_PTR_DTOR) is intentionally omitted because in 5.x ref_map is heterogeneous (stores both xmlNodePtr and zval* entries through the same API) and a ZVAL_PTR_DTOR would corrupt the xmlNodePtr entries. The addref alone closes the UAF; cost is one bounded zval leak per request, released with the emalloc pool at RSHUTDOWN. - CVE-2026-6722 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-5.6-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: soap extension use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION - debian/patches/php-5.6-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — wrap both zval_ptr_dtor(&soap_obj) sites in the header-handler failure paths with a persistance!=SOAP_PERSISTENCE_SESSION guard. - CVE-2026-7261 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri and query_string - debian/patches/php-5.6-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — fix bogus `ENT_HTML_IGNORE_ERRORS & ENT_COMPAT` (= 0) flag and add a parallel escape block for request_uri. - Note: upstream (PHP 8.x) routes JSON status output through php_json_encode_string(), which is not exported on 5.x. The 5.6 backport therefore applies the same HTML entity escape to both the HTML and JSON paths via the shared request_uri / query_string buffers. Consumers of `/status?json` will now see HTML-entity-encoded bytes in those fields (e.g. `&amp;` instead of `&`); entities decode back to the original byte but JSON consumers must be prepared to handle them. - CVE-2026-6735 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-7.0-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor to ZVAL_PTR_DTOR. - CVE-2026-6722 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-7.0-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri - debian/patches/php-7.0-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc.request_uri with php_escape_html_entities_ex() and fix the broken "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise-AND of two flag constants evaluates to 0). Adapted to 7.x layout (struct access "proc.X", single encode flag, older 6-arg php_escape_html_entities_ex signature). - CVE-2026-6735 * SECURITY UPDATE: soap SoapServer use-after-free after header parsing failure when SOAP_PERSISTENCE_SESSION is set - debian/patches/php-7.0-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj) call sites in PHP_METHOD(SoapServer, handle) with "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)". - CVE-2026-7261 * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input - debian/patches/php-7.0-CVE-2026-7568.patch: backport upstream commit 47def8ce1d in ext/standard/metaphone.c — retype w_idx and Lookahead's how_far/idx from int to size_t to avoid signed overflow while walking strings larger than 2 GB on 64-bit builds. - CVE-2026-7568 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-7.1-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor to ZVAL_PTR_DTOR. - CVE-2026-6722 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-7.1-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri - debian/patches/php-7.1-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc.request_uri with php_escape_html_entities_ex() and fix the broken "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise-AND of two flag constants evaluates to 0). Adapted to 7.x layout (struct access "proc.X", single encode flag, older 6-arg php_escape_html_entities_ex signature). - CVE-2026-6735 * SECURITY UPDATE: soap SoapServer use-after-free after header parsing failure when SOAP_PERSISTENCE_SESSION is set - debian/patches/php-7.1-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj) call sites in PHP_METHOD(SoapServer, handle) with "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)". - CVE-2026-7261 * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input - debian/patches/php-7.1-CVE-2026-7568.patch: backport upstream commit 47def8ce1d in ext/standard/metaphone.c — retype w_idx and Lookahead's how_far/idx from int to size_t to avoid signed overflow while walking strings larger than 2 GB on 64-bit builds. - CVE-2026-7568 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-7.2-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor to ZVAL_PTR_DTOR. - CVE-2026-6722 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-7.2-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri - debian/patches/php-7.2-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc.request_uri with php_escape_html_entities_ex() and fix the broken "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise-AND of two flag constants evaluates to 0). Adapted to 7.x layout (struct access "proc.X", single encode flag, older 6-arg php_escape_html_entities_ex signature). - CVE-2026-6735 * SECURITY UPDATE: soap SoapServer use-after-free after header parsing failure when SOAP_PERSISTENCE_SESSION is set - debian/patches/php-7.2-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj) call sites in PHP_METHOD(SoapServer, handle) with "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)". - CVE-2026-7261 * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input - debian/patches/php-7.2-CVE-2026-7568.patch: backport upstream commit 47def8ce1d in ext/standard/metaphone.c — retype w_idx and Lookahead's how_far/idx from int to size_t to avoid signed overflow while walking strings larger than 2 GB on 64-bit builds. - CVE-2026-7568 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-7.4-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor to ZVAL_PTR_DTOR. - CVE-2026-6722 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-7.4-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri - debian/patches/php-7.4-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc.request_uri with php_escape_html_entities_ex() and fix the broken "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise-AND of two flag constants evaluates to 0). Adapted to 7.x layout (struct access "proc.X", single encode flag, older 6-arg php_escape_html_entities_ex signature). - CVE-2026-6735 * SECURITY UPDATE: soap SoapServer use-after-free after header parsing failure when SOAP_PERSISTENCE_SESSION is set - debian/patches/php-7.4-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj) call sites in PHP_METHOD(SoapServer, handle) with "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)". - CVE-2026-7261 * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input - debian/patches/php-7.4-CVE-2026-7568.patch: backport upstream commit 47def8ce1d in ext/standard/metaphone.c — retype w_idx and Lookahead's how_far/idx from int to size_t to avoid signed overflow while walking strings larger than 2 GB on 64-bit builds. - CVE-2026-7568 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 Debian 11 * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-7.3-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor to ZVAL_PTR_DTOR. - CVE-2026-6722 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing <value> element - debian/patches/php-7.3-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri - debian/patches/php-7.3-CVE-2026-6735.patch: backport upstream commit 99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc.request_uri with php_escape_html_entities_ex() and fix the broken "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise-AND of two flag constants evaluates to 0). Adapted to 7.x layout (struct access "proc.X", single encode flag, older 6-arg php_escape_html_entities_ex signature). - CVE-2026-6735 * SECURITY UPDATE: soap SoapServer use-after-free after header parsing failure when SOAP_PERSISTENCE_SESSION is set - debian/patches/php-7.3-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj) call sites in PHP_METHOD(SoapServer, handle) with "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)". - CVE-2026-7261 * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input - debian/patches/php-7.3-CVE-2026-7568.patch: backport upstream commit 47def8ce1d in ext/standard/metaphone.c — retype w_idx and Lookahead's how_far/idx from int to size_t to avoid signed overflow while walking strings larger than 2 GB on 64-bit builds. - CVE-2026-7568 Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 alt-php82 alt-php82-bcmath alt-php82-cli alt-php82-common alt-php82-dba alt-php82-dev alt-php82-enchant alt-php82-firebird alt-php82-fpm alt-php82-gd alt-php82-imap alt-php82-intl alt-php82-ldap alt-php82-mbstring alt-php82-mysqlnd alt-php82-odbc alt-php82-opcache alt-php82-pdo alt-php82-pgsql alt-php82-process alt-php82-pspell alt-php82-snmp alt-php82-soap alt-php82-sodium alt-php82-tidy alt-php82-xml alt-php81 alt-php81-bcmath alt-php81-cli alt-php81-common alt-php81-dba alt-php81-dev alt-php81-enchant alt-php81-firebird alt-php81-fpm alt-php81-gd alt-php81-imap alt-php81-intl alt-php81-ldap alt-php81-mbstring alt-php81-mysqlnd alt-php81-odbc alt-php81-opcache alt-php81-pdo alt-php81-pgsql alt-php81-process alt-php81-pspell alt-php81-snmp alt-php81-soap alt-php81-sodium alt-php81-tidy alt-php81-xml alt-php80 alt-php80-bcmath alt-php80-cli alt-php80-common alt-php80-dba alt-php80-dev alt-php80-enchant alt-php80-firebird alt-php80-fpm alt-php80-gd alt-php80-imap alt-php80-intl alt-php80-ldap alt-php80-mbstring alt-php80-mysqlnd alt-php80-odbc alt-php80-opcache alt-php80-pdo alt-php80-pgsql alt-php80-process alt-php80-pspell alt-php80-snmp alt-php80-soap alt-php80-sodium alt-php80-tidy alt-php80-xml alt-php74 alt-php74-bcmath alt-php74-cli alt-php74-common alt-php74-dba alt-php74-dev alt-php74-enchant alt-php74-firebird alt-php74-fpm alt-php74-gd alt-php74-imap alt-php74-intl alt-php74-ldap alt-php74-mbstring alt-php74-mysqlnd alt-php74-odbc alt-php74-opcache alt-php74-pdo alt-php74-pgsql alt-php74-process alt-php74-pspell alt-php74-snmp alt-php74-soap alt-php74-sodium alt-php74-tidy alt-php74-xml alt-php74-xmlrpc alt-php73 alt-php73-bcmath alt-php73-cli alt-php73-common alt-php73-dba alt-php73-dev alt-php73-enchant alt-php73-firebird alt-php73-fpm alt-php73-gd alt-php73-imap alt-php73-intl alt-php73-ldap alt-php73-mbstring alt-php73-mysqlnd alt-php73-odbc alt-php73-opcache alt-php73-pdo alt-php73-pgsql alt-php73-process alt-php73-pspell alt-php73-recode alt-php73-snmp alt-php73-soap alt-php73-sodium alt-php73-tidy alt-php73-xml alt-php73-xmlrpc alt-php72 alt-php72-bcmath alt-php72-cli alt-php72-common alt-php72-dba alt-php72-dev alt-php72-enchant alt-php72-firebird alt-php72-fpm alt-php72-gd alt-php72-imap alt-php72-intl alt-php72-ldap alt-php72-mbstring alt-php72-mysqlnd alt-php72-odbc alt-php72-opcache alt-php72-pdo alt-php72-pgsql alt-php72-process alt-php72-pspell alt-php72-recode alt-php72-snmp alt-php72-soap alt-php72-sodium alt-php72-tidy alt-php72-xml alt-php72-xmlrpc alt-php71 alt-php71-bcmath alt-php71-cli alt-php71-common alt-php71-dba alt-php71-dev alt-php71-enchant alt-php71-firebird alt-php71-fpm alt-php71-gd alt-php71-imap alt-php71-intl alt-php71-ldap alt-php71-mbstring alt-php71-mcrypt alt-php71-mysqlnd alt-php71-odbc alt-php71-opcache alt-php71-pdo alt-php71-pgsql alt-php71-process alt-php71-pspell alt-php71-recode alt-php71-snmp alt-php71-soap alt-php71-tidy alt-php71-xml alt-php71-xmlrpc alt-php70 alt-php70-bcmath alt-php70-cli alt-php70-common alt-php70-dba alt-php70-dev alt-php70-enchant alt-php70-firebird alt-php70-fpm alt-php70-gd alt-php70-imap alt-php70-intl alt-php70-ldap alt-php70-mbstring alt-php70-mcrypt alt-php70-mysqlnd alt-php70-odbc alt-php70-opcache alt-php70-pdo alt-php70-pgsql alt-php70-process alt-php70-pspell alt-php70-recode alt-php70-snmp alt-php70-soap alt-php70-tidy alt-php70-xml alt-php70-xmlrpc alt-php56 alt-php56-bcmath alt-php56-cli alt-php56-common alt-php56-dba alt-php56-dbx alt-php56-dev alt-php56-enchant alt-php56-firebird alt-php56-fpm alt-php56-gd alt-php56-imap alt-php56-intl alt-php56-ldap alt-php56-mbstring alt-php56-mcrypt alt-php56-mysqlnd alt-php56-odbc alt-php56-opcache alt-php56-pdo alt-php56-pgsql alt-php56-process alt-php56-pspell alt-php56-recode alt-php56-snmp alt-php56-soap alt-php56-sybase alt-php56-tidy alt-php56-xml alt-php56-xmlrpc amd64 0:8.2.28-2 amd64 0:8.1.32-2 amd64 0:8.0.30-21 amd64 0:7.4.33-34 amd64 0:7.3.33-38 amd64 0:7.2.34-52 amd64 0:7.1.33-69 amd64 0:7.0.33-101 amd64 0:5.6.40-101 amd64 0:5.6.40-103 amd64 0:7.0.33-104 amd64 0:7.1.33-71 amd64 0:5.6.40-104 amd64 0:5.6.40-106 amd64 0:7.0.33-106 amd64 0:7.1.33-73 amd64 0:7.3.33-42 amd64 0:7.4.33-39 amd64 0:7.2.34-56 amd64 0:8.0.30-25 amd64 0:5.6.40-107 amd64 0:7.0.33-108 amd64 0:7.1.33-75 amd64 0:5.6.40-112 amd64 0:8.2.30-1 amd64 0:8.1.34-1 amd64 0:8.0.30-32.2 amd64 0:7.4.33-44.2 amd64 0:7.3.33-47.2 amd64 0:7.2.34-61.2 amd64 0:5.6.40-116 amd64 0:7.0.33-117 amd64 0:7.1.33-83 amd64 0:7.2.34-65 amd64 0:7.4.33-48 amd64 0:8.2.31-1 amd64 0:8.1.34-13 amd64 0:8.0.30-44 amd64 0:5.6.40-123 amd64 0:7.0.33-124 amd64 0:7.1.33-90 amd64 0:7.2.34-74 amd64 0:7.4.33-55 amd64 0:7.3.33-59