* SECURITY UPDATE: SQL injection in ext/pgsql via an E'...' backslash breakout (GHSA-7qpv-r5mr-78m4) - debian/patches/php-5.4-CVE-2026-17543.patch: php_pgsql_add_quotes() in ext/pgsql/pgsql.c wrapped a PQescapeStringConn()-escaped value in an E'...' literal, where a backslash still acts as an escape character, so a value such as "zzz\' OR 1=1 --" broke out of the literal and injected SQL through pg_convert()/pg_insert()/pg_update()/pg_delete()/ pg_select(); emit a plain '...' literal instead, which is what PQescapeStringConn() is meant to be paired with - CVE-2026-17543 * SECURITY UPDATE: bundled libgd GIF LZW decoder defects reachable from attacker-controlled GIF data via imagecreatefromgif() and friends - debian/patches/php-5.4-CVE-2026-9672.patch: in ext/gd/libgd/gd_gif_in.c, reset table[1][i] instead of repeatedly clearing table[1][0] when clearing the LZW table, return early once the LZW end code is seen instead of falling through with a stale code, and zero-initialise the LZW_STATIC_DATA scratch struct in ReadImage() - CVE-2026-9672 * SECURITY UPDATE: phar stack exhaustion (unbounded recursion) on circular symlink chains in tar-based archives (GHSA-vc5h-9ppw-p5f3) - debian/patches/php-5.4-CVE-2026-7260.patch: phar_get_link_source() in ext/phar/util.c resolved links by recursing into itself with no cycle detection; walk the chain iteratively with Floyd cycle detection over a new phar_follow_one_link() helper and return NULL on a cycle, and restore the path separator in phar_get_link_location() so that helper is idempotent across the two cursors - CVE-2026-7260