Commit 063d7875422 for php.net

commit 063d7875422db080bde510ba1b909b038993e1a0
Merge: 74e3a69df1a 35889a78d80
Author: Weilin Du <weilindu@php.net>
Date:   Sat Sep 12 14:32:08 2026 +0800

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix GH-23106: mb_strpos() overreads truncated UTF-8 haystacks (#23107)

diff --cc NEWS
index 1212b4fae18,8c4131fd642..5182713edfc
--- a/NEWS
+++ b/NEWS
@@@ -11,12 -11,12 +11,16 @@@ PH
      registrations are freed while still reachable from the cycle collector.
      (Ilia Alshanetsky)

+ - MBString:
+   . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
+     a truncated UTF-8 sequence). (Lazizbek Ergashev)
+
 +- SPL:
 +  . Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when
 +    __serialize() removes an element). (David Carlier)
 +

 -24 Sep 2026, PHP 8.5.11
 +10 Sep 2026, PHP 8.6.0beta3

  - BCMath:
    . Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds