- CVE-2026-93682: out-of-bounds read on an empty Location header when the http:// stream wrapper follows a redirect (ext/standard/http_fopen_wrapper.c, GH-23467). An empty Location header allocates a single byte for the NUL terminator, so the relative-redirect branch's read of location[1] over-read heap memory and could append a garbage-derived path to the redirect target instead of the host root. Net effect of upstream commits 8196275133ed and de3436c76e46: the length test uses header_info.location_len - already present on this branch from the CVE-2025-1861 backport - instead of strlen(), and the relative join is skipped unless the header is at least two bytes long. The guard is shipped directly in its final "location_len > 1" form; the intermediate "> 0" form of 8196275133ed is skipped, as it regressed single-character relative Location headers into resolving against the request path instead of the host root. Both changed lines are byte-identical to upstream. Upstream's two regression tests are carried as ext/standard/tests/http/http_empty_location_redirect.phpt and http_single_char_location_redirect.phpt, with the harness include switched to ext/openssl/tests/ServerClientTestCase2.inc, which is the copy on this branch that provides phpt_notify_server_start() and the {{ ADDR }} placeholder. - CVE-2026-91768: php-fpm listen.allowed_clients matched only the first 96 bits of an IPv6 address (sapi/fpm/fpm/fastcgi.c, GHSA-62xp-839h-2637). fcgi_is_allowed() memcmp()'d an incoming IPv6 peer against each allowed entry with a hardcoded length of 12, so any client sharing only the leading 96 bits of an allowed address was accepted - every host in the same /96, including the whole ::ffff:0:0/96 IPv4-mapped range for one mapped entry. Backport of upstream commit dcdfcf86fcf7; the comparison now uses sizeof(sin6_addr), all 128 bits. Byte-identical to upstream, only the file differs: 5.6 keeps the FastCGI protocol code in sapi/fpm/fpm/fastcgi.c, not main/fastcgi.c. Upstream's regression tests are not carried - they require the modern FPM test harness (sapi/fpm/tests/tester.inc, FPM\Tester, its {{ADDR:IPv6:ANY[...]}} placeholders and skipIfIPv6IsNotSupported()), which does not exist on this branch.