- CVE-2026-7260: phar circular symlink chain caused unbounded recursion in phar_get_link_source(); the chain is now walked iteratively with Floyd cycle detection and a cycle resolves to NULL. Applies to ext/phar/util.c from the bundled PECL phar-2.0.0, which is unpacked before patching. The NULL guard in phar_get_entry_data() that this relies on is already present via php-5.2.17-bug69720.patch. Adds ext/phar/tests/tar/gh21986.phpt, taken from the earlier public fix b2de3cf170 because it needs no binary fixture, adapted for 5.2 (--SKIPIF-- instead of --EXTENSIONS--, dirname(__FILE__) instead of __DIR__); %check picks it up automatically from this patch - CVE-2026-9672: bundled libgd GIF LZW decoder fixes in ext/gd/libgd/gd_gif_in.c - clear the whole suffix table (sd->table[1][i], not sd->table[1][0]), stop decoding unconditionally at the LZW end code, and zero-initialise the LZW_STATIC_DATA scratch struct in ReadImage()