* SECURITY UPDATE: phar circular symlink chain crash (CVE-2026-7260) - debian/patches/php-5.2-CVE-2026-7260.patch: backport upstream commit 2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 so phar_get_link_source() walks the symlink chain iteratively with Floyd cycle detection via a new static phar_follow_one_link() helper instead of recursing into itself, and resolves a circular chain to NULL. Applied to ext/phar/util.c from the bundled PECL phar-2.0.0 tarball, which prep_build unpacks into ext/phar before any patch runs. Also restores the directory separator in phar_get_link_location() so the helper is idempotent across the repeated visits the two-cursor walk performs. The NULL guard in phar_get_entry_data() that this depends on is already applied via php-5.2.17-bug69720.patch. - Adds ext/phar/tests/tar/gh21986.phpt, taken from the earlier public fix b2de3cf170 for the same defect because it needs no binary fixture; --EXTENSIONS-- becomes --SKIPIF-- and __DIR__ becomes dirname(__FILE__) for 5.2. The same test segfaults on an unpatched PHP 5.6.40 build and passes on a patched one. - CVE-2026-7260 * SECURITY UPDATE: bundled libgd GIF LZW decoder fixes (CVE-2026-9672) - debian/patches/php-5.2-CVE-2026-9672.patch: backport upstream commit fcd691b377d02285740744bee17c0f298be227d5 (patch by Pierre Joye) to ext/gd/libgd/gd_gif_in.c: clear the whole LZW suffix table (sd->table[1][i] instead of sd->table[1][0]) when resetting, terminate decoding unconditionally once the LZW end code is read instead of falling through with a stale code, and zero-initialise the LZW_STATIC_DATA scratch struct in ReadImage(). - CVE-2026-9672