* SECURITY UPDATE: out-of-bounds read on an empty Location header when the http:// wrapper follows a relative redirect - debian/patches/php-8.0-CVE-2026-93682.patch: backport upstream commits 8196275133 and de3436c76e in ext/standard/http_fopen_wrapper.c - use header_info.location_len instead of strlen() and reading location[1], so an empty Location header no longer over-reads the heap. Net effect of both commits: the relative-join check is location_len > 1. Carries the upstream http_empty_location_redirect.phpt and http_single_char_location_redirect.phpt tests, adapted to include ServerClientTestCase2.inc. - CVE-2026-93682 * SECURITY UPDATE: FastCGI listen.allowed_clients compared only the first 96 bits of IPv6 addresses - debian/patches/php-8.0-CVE-2026-91768.patch: backport upstream commit dcdfcf86fc in main/fastcgi.c - compare the full sizeof(sin6_addr) in fcgi_is_allowed(). Carries the upstream ghsa-62xp-839h-2637 FPM tests, adapted to this branch's log matcher (child \d+ in place of the printf-style placeholder). - CVE-2026-91768