- CVE-2026-9672: three defects in the GIF LZW decoder of the bundled libgd (ext/gd/libgd/gd_gif_in.c), reachable from attacker-controlled GIF data: the prefix/suffix table reset cleared table[1][0] repeatedly instead of table[1][i], the LZW end_code branch fell through and kept decoding with a stale code when the trailing data blocks drained cleanly, and ReadImage() left its LZW_STATIC_DATA scratch struct uninitialised. Backport of upstream commit fcd691b377d0 (libgd patch by Pierre Joye), byte-identical to upstream. - CVE-2026-17543: SQL injection in ext/pgsql (GHSA-7qpv-r5mr-78m4). php_pgsql_add_quotes() wrapped a PQescapeStringConn()-escaped value in an E'...' literal, where a backslash is an escape character, so a value such as "zzz\' OR 1=1 --" escaped the doubled quote and broke out of the literal via pg_convert()/pg_insert()/pg_update()/pg_delete()/pg_select(). Backport of upstream commit ab048bd83b57: emit a plain '...' literal, which is what PQescapeStringConn() is documented to be used with. 5.6 builds the literal with smart_str, so the fix drops the smart_str_appendc(&str, 'E') call. The pg_convert()/pg_insert()/pg_update() expectations are updated for the dropped E prefix, including the 5.6-era non-"_9" duplicates upstream no longer ships, and a 5.6-compatible replacement for the upstream regression test is added. - CVE-2026-7260: phar stack exhaustion on a circular symlink chain in a tar-based archive (GHSA-vc5h-9ppw-p5f3). phar_get_link_source() recursed into itself with no cycle detection, so an archive whose symlinks form a loop crashed the process on open/read. Backport of upstream commit 2e0fa0a44441: a new static phar_follow_one_link() performs a single hop and phar_get_link_source() walks the chain iteratively with Floyd cycle detection (kept on the 5.6 zend_hash_find()/TSRMLS API). Also restores the path separator in phar_get_link_location() ("*p = '/'"), without which the Floyd walk's second visit to an entry resolves a truncated prefix and crashes on *valid* nested archives; upstream carries the same defect but its fixtures use flat entry names and never reach that branch. Adds ext/phar/tests/tar/gh21986.phpt, taken from the earlier public fix b2de3cf170 because it needs no binary fixture; it segfaults on an unpatched 5.6.40 build and passes on a patched one.