* SECURITY UPDATE: heap out-of-bounds read in the http:// wrapper when a redirect response carries an empty Location header - debian/patches/php-5.3-CVE-2026-93682.patch: backport upstream commits 8196275133edb830ec85330d36659d5b257b44db (GH-23467) and de3436c76e460ca44829cc8234926280d96ceae6 (GH-23521) to ext/standard/http_fopen_wrapper.c. An empty Location header allocates a single byte for the NUL terminator, so the relative-redirect branch's *(header_info.location+1) read ran one byte past the end of the allocation; because that read decided whether the target was joined to the request path, a garbage-derived path could be appended to the redirect target instead of the correct host root. The check now tests the already-tracked header_info.location_len, and the nearby length test uses location_len in place of strlen(), so the second byte is never read. Only the net effect of the two commits is shipped: the relative-join check goes straight to location_len > 1, the final form from GH-23521, so a one-character Location keeps resolving against the host root instead of the request path. header_info.location_len is already present on this branch from the CVE-2025-1861 backport, so both source changes apply unchanged. The two upstream .phpt tests are carried, adapted to include ServerClientTestCase2.inc (the variant shipped by the CVE-2025-1861 backport that provides the {{ ADDR }} substitution and phpt_notify_server_start()) and to avoid PHP 5.4+ syntax. - CVE-2026-93682