Php 8.1 security backport#1

Draft

andypost wants to merge 7 commits into

PHP-8.1-security-backport

Commits on May 5, 2026

GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions

iluuu1994
authored and
andypost
committed
GHSA-96wq-48vp-hh57: [metaphone] Fix signed integer overflow of char array offset

TimWolla
authored and
andypost
committed
GHSA-wm6j-2649-pv75: [mbstring] Fix null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

vi3tL0u1s
authored and
andypost
committed
GHSA-7qg2-v9fj-4mwv: [fpm] XSS within status endpoint

bukka
authored and
andypost
committed
GHSA-hmxp-6pc4-f3vv: [soap] Fix broken Apache map value NULL check

iluuu1994
authored and
andypost
committed
GHSA-m33r-qmcv-p97q: [soap] Fix use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION

iluuu1994
authored and
andypost
committed
GHSA-85c2-q967-79q5: [soap] Fix stale SOAP_GLOBAL(ref_map) pointer with Apache Map

iluuu1994
authored and
andypost
committed