- CVE-2025-14181: fix 32-bit length overflow in the SOAP HTTP client by using overflow-checked zend_string_safe_alloc()/zend_string_safe_realloc() growth in get_http_body() and make_http_soap_request() in ext/soap/php_http.c (GHSA-cj93-vc83-wgqv); add regression test ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt - CVE-2026-6103: fix phar tar entry injection by rejecting unparsable or unrepresentable entry sizes and skipping the data blocks of every entry type that carries data in ext/phar/tar.c and ext/phar/phar_internal.h (GHSA-j3wh-g957-2m85); add three regression tests under ext/phar/tests/tar - CVE-2026-91765: fix unbounded recursion in SOAP XML parsing and decoding by bounding nesting depth in ext/soap/php_encoding.c, php_xml.c, soap.c and php_soap.h (GHSA-rgrp-mwpx-f6rm); add regression tests under ext/soap/tests - CVE-2026-91766: strip Authorization, Cookie and Proxy-Authorization from user-supplied headers on cross-origin redirects in ext/standard/http_fopen_wrapper.c (GHSA-fpwc-w8rq-cr92); add regression test ext/standard/tests/http/ghsa-fpwc-w8rq-cr92.phpt and update the pre-existing ext/standard/tests/http/bug61548.phpt expectation as upstream did - CVE-2026-91769: do not fall back to matching the certificate CN when the certificate presents a DNS-ID, SRV-ID or URI-ID subjectAltName, per RFC 6125 6.4.4, in ext/openssl/xp_ssl.c (GHSA-vvx9-73fr-5jjx); add regression tests under ext/openssl/tests and update the pre-existing san_peer_matching.phpt expectation as upstream did