- CVE-2026-17543: SQL injection in ext/pgsql via an E'...' backslash breakout (GHSA-7qpv-r5mr-78m4); php_pgsql_add_quotes() wrapped a PQescapeStringConn()-escaped value in an E'...' literal, where a backslash still acts as an escape character, so a value such as "zzz\' OR 1=1 --" broke out of the literal and injected SQL through pg_convert(), pg_insert(), pg_update(), pg_delete() and pg_select(); emit a plain '...' literal instead, which is what PQescapeStringConn() is meant to be paired with - CVE-2026-9672: bundled libgd GIF LZW decoder defects in ext/gd/libgd/gd_gif_in.c; reset table[1][i] instead of table[1][0] when clearing the LZW table, stop decoding once the LZW end code is seen instead of falling through with a stale code, and zero-initialise the LZW_STATIC_DATA scratch struct in ReadImage() - CVE-2026-7260: phar stack exhaustion (unbounded recursion) on circular symlink chains in tar-based archives (GHSA-vc5h-9ppw-p5f3); replace the self-recursion in phar_get_link_source() with an iterative Floyd cycle-detection walk over a new phar_follow_one_link() helper, and restore the path separator in phar_get_link_location() so that helper is idempotent