Commit d6bb264d4b4 for php

commit d6bb264d4b46d3b86e73b9a096369616cc3421c3
Merge: 7dc666cf4f3 3323b8db05d
Author: Jakub Zelenka <bukka@php.net>
Date:   Fri Oct 30 12:52:57 2026 +0100

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      ext/standard: Validate objects before queuing unserialize callbacks

diff --cc NEWS
index 73e7d4c3c42,4db408f8772..95f3867aee8
--- a/NEWS
+++ b/NEWS
@@@ -152,146 -234,10 +152,148 @@@ PH
  - Standard:
    . Fixed memory leaks in checkdnsrr() and dns_check_record() on Windows.
      (Ilia Alshanetsky)
+   . Fixed __unserialize() and __wakeup() being called for objects with a missing
+     closing brace. (Ilia Alshanetsky)
    . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
      was not opened by PHP). (lazerg)
 +  . Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and
 +    krsort() are still locale-dependent). (Lazizbek Ergashev, Jon Surrell)
 +  . Fix use-after-free in Randomizer::shuffleArray() when the engine throws.
 +    (Marti2203)
 +
 +- Streams:
 +  . Fixed bug GH-24506 (stream_select() leaks a stream-error operation level
 +    on its FD_SETSIZE failure path). (azjezz)
 +  . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
 +    parsing fails after Transfer-Encoding). (bercedev)
 +  . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
 +    Location header). (bercedev)
 +
 +- Zip:
 +  . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
 +    configuration. (Weilin Du)
 +  . Excluded libzip 1.12.0 due to a regression preventing additions and
 +    replacements in torrentzip archives. (Weilin Du)
 +
 +- Zlib:
 +  . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2
 +    CMake build does not emit it). (Lazizbek Ergashev)
 +
 +21 Oct 2026, PHP 8.6.0RC4
 +
 +- Core:
 +  . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
 +    bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
 +    ndossche, Nicolas Grekas)
 +  . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
 +    graceful restart, potentially causing incompatible OPcache file cache
 +    entries to be reused). (Levi Morrison)
 +  . Fixed memory leak when an exception already contains the pending exception
 +    in its previous chain. (Edmond)
 +  . Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
 +    enclosing function). (ndossche)
 +  . Fixed memory manager keeping a block reallocated to exactly the size of
 +    the next smaller bin in its larger bin, which efree_size() then freed
 +    into the wrong one. (Marc Bennewitz)
 +  . Fix throwing behaviour with recursive arrays in VM. (ndossche)
 +  . Fixed skipped catch block when switching fibers during exception unwinding
 +    (Nicolas Grekas)
 +  . Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
 +  . Fixed array_map() optimization not resolving the class name of a static
 +    first-class callable. (Claudio Dekker)
 +
 +- Date:
 +  . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property
 +    hash construction). (heathdutton)
 +  . Fixed bug GH-24350 (MINIT reads a stale external tz database after an
 +    in-process module restart). (Lazizbek Ergashev)
 +
 +- Fileinfo:
 +  . Fixed bug GH-24289 (finfo::file() reports the wrong argument number for
 +    an invalid $filename). (Lazizbek Ergashev)
 +
 +- FPM:
 +  . Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is
 +    SHUT_RD in WASI). (Ryosuke Ishibashi)
 +
 +- FTP:
 +  . Fix double free in ext/ftp data_accept() on accept failure. (alepacheco)
 +
 +- MBString:
 +  . Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
 +  . Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead
 +    byte at the end of a multipart field name. (Jorg Sowa)
 +
 +- MySQLnd:
 +  . Fixed bug GH-24293 (Segfault on connect with an empty password to a
 +    MariaDB PAM account). (lazerg)
 +
 +- Opcache:
 +  . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a
 +    root trace at the opcache.jit_max_root_traces limit, causing spurious
 +    "Too few arguments" errors and crashes). (RV7PR)
 +  . Fix type inference of ADD_ARRAY_UNPACK with integer keys. (ndossche)
 +  . Fix too wide type inference for ASSIGN_DIM_OP. (ndossche)
 +  . Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)
 +  . Fix exception checks due to NAN warnings and object empty()'s. (ndossche)
 +  . Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls
 +    in closures). (RV7PR)
 +  . Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
 +    property). (Lazizbek Ergashev)
 +  . Fixed bug GH-24185 (Windows ZTS: random access violations with OPcache JIT
 +    in multi-process setups). (Arnaud, ndossche)
 +  . Fix SIGFPE on LONG_MIN % -1 with a constant divisor. (waroad)
 +  . Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side
 +    exits). (Lazizbek Ergashev)
 +  . Fixed bug GH-24391 (JIT switch on constant null takes default instead of
 +    case 0). (ndossche)
 +  . Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI
 +    is reloaded from memory). (ndossche)
 +  . Fixed bug GH-24386 (JIT: register operand must be loaded before the typed
 +    reference check). (ndossche)
 +  . Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in
 +    zend_jit_assign_dim_op()). (waroad)
 +  . Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is
 +    passed to a run-time-resolved function). (waroad)
 +  . Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call
 +    exits with an uninitialized opline). (waroad)
 +
 +- PDO:
 +  . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
 +    (Ilia Alshanetsky)
 +  . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
 +    persistent connection. (Ilia Alshanetsky)
 +  . Fixed constructor option errors naming argument #3 ($password) instead
 +    of argument #4 ($options). (Ilia Alshanetsky)
 +
 +- Phpdbg:
 +  . Fix wrong command names. (ndossche, Weilin Du)
 +
 +- Phar:
 +  . Fixed GH-24166 (Double-free in Phar::webPhar() in CGI without PATH_INFO).
 +    (RigelYoung, Jakub Zelenka)
 +
 +- POSIX:
 +  . Fixed posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris.
 +    (Jorg Sowa)
 +
 +- Readline:
 +  . Fixed a crash in readline_info() when completion_append_character
 +    contains a non-ASCII byte. (Weilin Du)
 +
 +- Session:
 +  . Fixed session_write_close() keeping the save handler open when the
 +    session data cannot be encoded. (Ilia Alshanetsky)
 +  . Fixed session data loss in the files save handler when writing the session
 +    file fails after it was already truncated. (Ilia Alshanetsky)
 +
 +- SOAP:
 +  . Fixed bug GH-23686 (SoapClient only strips `Authorization: Basic` when a
 +    WSDL imports from another host). (DanielEScherzer)
 +
 +- Standard:
 +  . Fixed chown() and lchown() failing to resolve user names in ZTS builds
 +    when getpwnam_r() needs a larger buffer. (Ilia Alshanetsky)
    . Fixed password_get_info() and password_needs_rehash() accepting malformed
      bcrypt costs. (Ilia Alshanetsky)
    . Fixed proc_open() null descriptor not being inheritable on Windows.