* SECURITY UPDATE: three defects in the bundled libgd GIF LZW decoder - debian/patches/php-7.1-CVE-2026-9672.patch: backport upstream commit fcd691b377 in ext/gd/libgd/gd_gif_in.c - reset sd->table[1][i] instead of sd->table[1][0] so the suffix table is fully cleared between images, stop decoding once the LZW end code is seen instead of falling through with a stale code, and zero-initialise LZW_STATIC_DATA in ReadImage(). - CVE-2026-9672 * SECURITY UPDATE: SQL injection in ext/pgsql via an E'...' backslash breakout - debian/patches/php-7.1-CVE-2026-17543.patch: backport upstream commit ab048bd83b in ext/pgsql/pgsql.c - php_pgsql_add_quotes() no longer emits the E prefix, since PQescapeStringConn() only doubles the single quote and a trailing backslash could therefore escape the closing quote of an E'...' literal. Test expectations updated accordingly and a regression test added. - CVE-2026-17543 * SECURITY UPDATE: phar crash on circular symlinks - debian/patches/php-7.1-CVE-2026-7260.patch: backport upstream commit 2e0fa0a444 in ext/phar/util.c - phar_get_link_source() follows the link chain with Floyd cycle detection via a new phar_follow_one_link() helper instead of recursing into itself until the C stack is exhausted, and phar_get_link_location() restores the path separator it temporarily overwrites in entry->filename. - CVE-2026-7260