* SECURITY UPDATE: out-of-bounds read when following a redirect with an empty Location header - debian/patches/php-7.2-CVE-2026-93682.patch: an empty Location header makes the http:// wrapper allocate a single byte for the NUL terminator, but the relative-redirect branch in ext/standard/http_fopen_wrapper.c still read location[1] to decide whether to join the target against the request path, over-reading heap memory and potentially appending a garbage-derived path to the redirect target instead of the host root. The scheme test now uses header_info.location_len instead of strlen() on the same buffer, and the relative join is guarded by location_len > 1, so the second byte is never read. The > 1 bound is upstream's end state after the GH-23521 follow-up: the first fix used > 0, which made a single-character Location resolve against the request path rather than the host root, and that intermediate behaviour is not shipped here. - CVE-2026-93682 * SECURITY UPDATE: FastCGI listen.allowed_clients compared only 96 bits of an IPv6 address - debian/patches/php-7.2-CVE-2026-91768.patch: fcgi_is_allowed() in main/fastcgi.c compared an incoming IPv6 peer address against each configured allowed client with memcmp() over a hardcoded 12 bytes, so only the first 96 bits were checked and the low 32 bits were ignored. Any address sharing the first 96 bits with an allowed entry was accepted, which for an IPv4-mapped entry such as ::ffff:a.b.c.d means the whole embedded IPv4 address went unchecked. The comparison now uses sizeof(client_sa.sa_inet6.sin6_addr), covering all 128 bits (GHSA-62xp-839h-2637). - CVE-2026-91768