diff --git a/.gitignore b/.gitignore
index 4d8e21c..bc3d9be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/php-7.2.11.tar.xz
+SOURCES/php-7.2.24.tar.xz
diff --git a/.php.metadata b/.php.metadata
index 296c37f..6c8d691 100644
--- a/.php.metadata
+++ b/.php.metadata
@@ -1 +1 @@
-4fd355950fdbe39cdab1b2bac03f25160bd441ec SOURCES/php-7.2.11.tar.xz
+d31628bdc89a724a2a0950c2ed7d79b40cf489a7 SOURCES/php-7.2.24.tar.xz
diff --git a/SOURCES/php-5.4.0-phpize.patch b/SOURCES/php-7.2.12-phpize.patch
similarity index 60%
rename from SOURCES/php-5.4.0-phpize.patch
rename to SOURCES/php-7.2.12-phpize.patch
index e666e45..77913a5 100644
--- a/SOURCES/php-5.4.0-phpize.patch
+++ b/SOURCES/php-7.2.12-phpize.patch
@@ -1,6 +1,7 @@
---- php-5.4.0RC5/scripts/phpize.in.orig	2012-01-18 17:13:54.018022983 +0100
-+++ php-5.4.0RC5/scripts/phpize.in	2012-01-18 17:14:40.614024941 +0100
-@@ -162,6 +162,15 @@
+diff -up php-7.2.12RC1/scripts/phpize.in.headers php-7.2.12RC1/scripts/phpize.in
+--- php-7.2.12RC1/scripts/phpize.in.headers	2018-10-23 11:47:43.000000000 +0200
++++ php-7.2.12RC1/scripts/phpize.in	2018-10-23 11:49:51.651818777 +0200
+@@ -162,6 +162,15 @@ phpize_autotools()
    $PHP_AUTOHEADER || exit 1
  }
  
@@ -15,8 +16,8 @@
 +
  # Main script
  
- case "$1" in 
-@@ -180,12 +189,15 @@
+ case "$1" in
+@@ -180,12 +189,15 @@ case "$1" in
  
    # Version
    --version|-v)
diff --git a/SOURCES/php-7.2.3-systzdata-v16.patch b/SOURCES/php-7.2.16-systzdata-v17.patch
similarity index 95%
rename from SOURCES/php-7.2.3-systzdata-v16.patch
rename to SOURCES/php-7.2.16-systzdata-v17.patch
index e488beb..640bff2 100644
--- a/SOURCES/php-7.2.3-systzdata-v16.patch
+++ b/SOURCES/php-7.2.16-systzdata-v17.patch
@@ -5,6 +5,7 @@ Add support for use of the system timezone database, rather
 than embedding a copy.  Discussed upstream but was not desired.
 
 History:
+r17: adapt for autotool change in 7.2.16RC1
 r16: adapt for timelib 2017.06 (in 7.2.3RC1)
 r15: adapt for timelib 2017.05beta7 (in 7.2.0RC1)
 r14: improve check for valid tz file
@@ -27,9 +28,32 @@ r3: fix a crash if /usr/share/zoneinfo doesn't exist (Raphael Geissert)
 r2: add filesystem trawl to set up name alias index
 r1: initial revision
 
-diff -up php-7.2.3RC1/ext/date/lib/parse_tz.c.systzdata php-7.2.3RC1/ext/date/lib/parse_tz.c
---- php-7.2.3RC1/ext/date/lib/parse_tz.c.systzdata	2018-02-13 20:18:34.000000000 +0100
-+++ php-7.2.3RC1/ext/date/lib/parse_tz.c	2018-02-14 06:14:23.484804852 +0100
+diff -up php-7.2.16RC1/ext/date/config0.m4.systzdata php-7.2.16RC1/ext/date/config0.m4
+--- php-7.2.16RC1/ext/date/config0.m4.systzdata	2019-02-19 11:22:22.223741585 +0100
++++ php-7.2.16RC1/ext/date/config0.m4	2019-02-19 11:23:05.089111556 +0100
+@@ -10,6 +10,19 @@ io.h
+ dnl Check for strtoll, atoll
+ AC_CHECK_FUNCS(strtoll atoll)
+ 
++PHP_ARG_WITH(system-tzdata, for use of system timezone data,
++[  --with-system-tzdata[=DIR]      to specify use of system timezone data],
++no, no)
++
++if test "$PHP_SYSTEM_TZDATA" != "no"; then
++   AC_DEFINE(HAVE_SYSTEM_TZDATA, 1, [Define if system timezone data is used])
++
++   if test "$PHP_SYSTEM_TZDATA" != "yes"; then
++      AC_DEFINE_UNQUOTED(HAVE_SYSTEM_TZDATA_PREFIX, "$PHP_SYSTEM_TZDATA",
++                         [Define for location of system timezone data])
++   fi
++fi
++
+ PHP_DATE_CFLAGS="-I@ext_builddir@/lib -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 -DHAVE_TIMELIB_CONFIG_H=1"
+ timelib_sources="lib/astro.c lib/dow.c lib/parse_date.c lib/parse_tz.c
+                  lib/timelib.c lib/tm2unixtime.c lib/unixtime2tm.c lib/parse_iso_intervals.c lib/interval.c"
+diff -up php-7.2.16RC1/ext/date/lib/parse_tz.c.systzdata php-7.2.16RC1/ext/date/lib/parse_tz.c
+--- php-7.2.16RC1/ext/date/lib/parse_tz.c.systzdata	2019-02-19 11:13:22.000000000 +0100
++++ php-7.2.16RC1/ext/date/lib/parse_tz.c	2019-02-19 11:19:40.245313535 +0100
 @@ -25,8 +25,21 @@
  #include "timelib.h"
  #include "timelib_private.h"
@@ -632,23 +656,3 @@ diff -up php-7.2.3RC1/ext/date/lib/parse_tz.c.systzdata php-7.2.3RC1/ext/date/li
  	} else {
  		*error_code = TIMELIB_ERROR_NO_SUCH_TIMEZONE;
  		tmp = NULL;
-diff -up php-7.2.3RC1/ext/date/lib/timelib.m4.systzdata php-7.2.3RC1/ext/date/lib/timelib.m4
---- php-7.2.3RC1/ext/date/lib/timelib.m4.systzdata	2018-02-13 20:18:34.000000000 +0100
-+++ php-7.2.3RC1/ext/date/lib/timelib.m4	2018-02-14 06:11:54.273089963 +0100
-@@ -81,3 +81,16 @@ io.h
- 
- dnl Check for strtoll, atoll
- AC_CHECK_FUNCS(strtoll atoll strftime gettimeofday)
-+
-+PHP_ARG_WITH(system-tzdata, for use of system timezone data,
-+[  --with-system-tzdata[=DIR]      to specify use of system timezone data],
-+no, no)
-+
-+if test "$PHP_SYSTEM_TZDATA" != "no"; then
-+   AC_DEFINE(HAVE_SYSTEM_TZDATA, 1, [Define if system timezone data is used])
-+
-+   if test "$PHP_SYSTEM_TZDATA" != "yes"; then
-+      AC_DEFINE_UNQUOTED(HAVE_SYSTEM_TZDATA_PREFIX, "$PHP_SYSTEM_TZDATA",
-+                         [Define for location of system timezone data])
-+   fi
-+fi
diff --git a/SPECS/php.spec b/SPECS/php.spec
index 0b01966..ec4b1b3 100644
--- a/SPECS/php.spec
+++ b/SPECS/php.spec
@@ -60,13 +60,12 @@
 %global with_tidy     0
 %endif
 
-%global upver        7.2.11
-#global rcver        RC1
+%global upver        7.2.24
 
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -101,9 +100,9 @@ Patch8: php-7.2.0-libdb.patch
 
 # Functional changes
 Patch40: php-7.2.4-dlopen.patch
-Patch42: php-7.2.3-systzdata-v16.patch
+Patch42: php-7.2.16-systzdata-v17.patch
 # See http://bugs.php.net/53436
-Patch43: php-5.4.0-phpize.patch
+Patch43: php-7.2.12-phpize.patch
 # Use -lldap_r for OpenLDAP
 Patch45: php-7.2.3-ldap_r.patch
 # Make php_config.h constant across builds
@@ -602,7 +601,7 @@ Provides: php-pdo_dblib, php-pdo_dblib%{?_isa}
 %description pdo-dblib
 The php-pdo-dblib package contains a dynamic shared object
 that implements the PHP Data Objects (PDO) interface to enable access from
-PHP to Microsoft SQL Server and Sybase databases through the FreeTDS libary.
+PHP to Microsoft SQL Server and Sybase databases through the FreeTDS library.
 %endif
 
 %package embedded
@@ -751,8 +750,13 @@ mkdir build-cgi build-apache build-embedded \
 rm ext/date/tests/timezone_location_get.phpt
 rm ext/date/tests/timezone_version_get.phpt
 rm ext/date/tests/timezone_version_get_basic1.phpt
+rm ext/date/tests/bug33414-1.phpt
+rm ext/date/tests/bug33415-2.phpt
+rm ext/date/tests/date_modify-1.phpt
 # fails sometime
+rm ext/date/tests/bug73837.phpt
 rm ext/sockets/tests/mcast_ipv?_recv.phpt
+rm sapi/cli/tests/upload_2G.phpt
 # cause stack exhausion
 rm Zend/tests/bug54268.phpt
 rm Zend/tests/bug68412.phpt
@@ -1565,6 +1569,12 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
 
 
 %changelog
+* Thu Nov  7 2019 Remi Collet <rcollet@redhat.com> - 7.2.24-1
+- update to 7.2.24 #1726981
+
+* Tue Oct 29 2019 Remi Collet <rcollet@redhat.com> - 7.2.11-4
+- fix underflow in env_path_info in fpm_main.c CVE-2019-11043
+
 * Wed May 15 2019 Joe Orton <jorton@redhat.com> - 7.2.11-2
 - rebuild (#1695587)