* SECURITY UPDATE: out-of-bounds read on an empty Location header when the http:// stream wrapper follows a redirect - debian/patches/php-5.6-CVE-2026-93682.patch: backport the net effect of upstream commits 8196275133ed (GH-23467) and de3436c76e46 (GH-23521) in ext/standard/http_fopen_wrapper.c. An empty Location header allocates a single byte for the NUL terminator, so the relative-redirect branch's read of location[1] over-read heap memory and could append a garbage-derived path to the redirect target instead of the host root. The length test now uses header_info.location_len, which this branch already carries from the CVE-2025-1861 backport, instead of strlen(), and the relative join is skipped when the header is shorter than two bytes so the second byte is never read. - Note: the guard lands directly on its final "location_len > 1" form. The intermediate "> 0" form from 8196275133ed is deliberately not shipped: it regressed single-character relative Location headers into resolving against the request path rather than the host root, which is what de3436c76e46 then fixed. Both changed lines are byte-identical to upstream; only the hunk offsets and the surrounding context differ (5.6 keeps resource->path as a plain char *). Upstream's two regression tests are carried as ext/standard/tests/http/http_empty_location_redirect.phpt and http_single_char_location_redirect.phpt, with the harness include switched to ext/openssl/tests/ServerClientTestCase2.inc, the copy that has phpt_notify_server_start() and the {{ ADDR }} placeholder on this branch. - CVE-2026-93682 * SECURITY UPDATE: php-fpm listen.allowed_clients matched only the first 96 bits of an IPv6 address - debian/patches/php-5.6-CVE-2026-91768.patch: backport upstream commit dcdfcf86fcf7 (GHSA-62xp-839h-2637) in sapi/fpm/fpm/fastcgi.c. fcgi_is_allowed() compared an incoming IPv6 peer against each entry of listen.allowed_clients with a hardcoded length of 12 bytes, so any client sharing only the first 96 bits of an allowed address was let through - every host in the same /96 as a permitted one, including the whole ::ffff:0:0/96 IPv4-mapped range for a single mapped entry. The comparison now covers sizeof(sin6_addr), all 128 bits. - Note: the changed line is byte-identical to upstream; only its location differs, as the FastCGI protocol code lives in sapi/fpm/fpm/fastcgi.c on 5.6 rather than main/fastcgi.c. Upstream's two regression tests are not carried: they need the modern FPM test harness (sapi/fpm/tests/tester.inc with the FPM\Tester class, its {{ADDR:IPv6:ANY[...]}} placeholders and skipIfIPv6IsNotSupported()), which does not exist on this branch. - CVE-2026-91768