Beta Branch update PHP 7.2-8.1 EOL security backport patches in 140.00beta01

update PHP 7.2-8.1 EOL security backport patches in 140.00beta01

Bring the PHP 7.2-8.1 EOL security patches up to date with the latest
upstream backports: follow-up fixes to three existing PHP 7.4/8.0/8.1
backports, and the PHP 8.2.34 SOAP fixes now backported to PHP 7.2/7.3.

Changes:
- php742/php80/php81-cve-2026-7568.patch: cast the -d option value to
unsigned char before isalnum() in the CLI, CGI, FPM and phpdbg SAPIs
(GHSA-m8rr-4c36-8gq4 follow-up)
- php742/php80-cve-2026-17543.patch: release the escaped string when
PQescapeStringConn() reports an error in php_pgsql_convert()
(GHSA-hrwm-9436-5mv3 follow-up)
- php742-gh22643.patch: DatePeriod::__construct() restores error handling
when the DateInterval is not initialized, so later warnings in the
request are no longer thrown as exceptions
- php7234-from-8.2.34-to-7.2.patch: unbounded recursion in SOAP XML
parsing and decoding (CVE-2026-91765, GHSA-rgrp-mwpx-f6rm)
- php7331-from-8.2.34-to-7.3.patch: the same SOAP recursion fix plus
integer overflow to buffer overflow in SOAP HTTP parsing
(CVE-2025-14181, GHSA-cj93-vc83-wgqv)
- inc/php_patch.inc: add from-8.2.34-to-7.2 and from-8.2.34-to-7.3 to the
PHP 7.2/7.3 lists, before cve-2026-109618

Continue reading...

---

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01