Commit 35889a78d80 for php.net

commit 35889a78d804cf0b14b9fd3b113a2430fb00e2eb
Merge: 718409371c5 cc22056f9db
Author: Weilin Du <weilindu@php.net>
Date:   Sat Sep 12 14:29:29 2026 +0800

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix GH-23106: mb_strpos() overreads truncated UTF-8 haystacks (#23107)

diff --cc NEWS
index 37f27f3572c,c367688672c..8c4131fd642
--- a/NEWS
+++ b/NEWS
@@@ -11,8 -11,16 +11,12 @@@ PH
      registrations are freed while still reachable from the cycle collector.
      (Ilia Alshanetsky)

+ - MBString:
+   . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
+     a truncated UTF-8 sequence). (Lazizbek Ergashev)
+
 -- Zip:
 -  . Fixed ZipArchive::extractTo() ignoring files given in a non-list array.
 -    (David Carlier)

 -
 -24 Sep 2026, PHP 8.4.26
 +24 Sep 2026, PHP 8.5.11

  - BCMath:
    . Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds