- Fix leak on double DatePeriod::__construct() call

- Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 Resolves: RHEL-223940
2026-08-04 11:29:11 +02:00 · 2026-08-04 11:29:11 +02:00 · 1a03b9047c
commit 1a03b9047c
parent 202b6026db
6 changed files with 531 additions and 2 deletions
--- a/.gitignore
+++ b/.gitignore
@ -10,5 +10,7 @@ php-8.2.*.xz
 php-8.2.*.xz.asc
 php-8.3.*.xz
 php-8.3.*.xz.asc
+php-8.4.*.xz
+php-8.4.*.xz.asc
 /php-8.0.30.tar.xz
 /php-8.0.30.tar.xz.asc
--- a/php-cve2026-17543.patch
+++ b/php-cve2026-17543.patch
@ -0,0 +1,226 @@
+From 531196af8ccc43c26ca97aef27b0816e8b4e2f60 Mon Sep 17 00:00:00 2001
+From: Ilija Tovilo <ilija.tovilo@me.com>
+Date: Mon, 27 Jul 2026 16:49:38 +0200
+Subject: [PATCH 2/5] Fix SQL injection in ext-pgsql via E'...' backslash
+ breakout
+
+php_pgsql_add_quotes() quotes the string with E'...', but PQescapeStringConn()
+does not escape \ unless standard_conforming_strings is off.
+PQescapeStringConn() is meant to be used with '', so do that instead.
+
+Fixes GHSA-7qpv-r5mr-78m4
+
+(cherry picked from commit ab048bd83b578119cf81b456526d50498421d617)
+(cherry picked from commit eb0de306e0569f8b50065a42f13dd3e2b3729532)
+---
+ ext/pgsql/pgsql.c                            |  5 +-
+ ext/pgsql/tests/10pg_convert_9.phpt          | 18 +++++-
+ ext/pgsql/tests/10pg_convert_json_array.phpt |  4 +-
+ ext/pgsql/tests/12pg_insert_9.phpt           |  2 +-
+ ext/pgsql/tests/14pg_update_9.phpt           |  2 +-
+ ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt     | 58 ++++++++++++++++++++
+ ext/pgsql/tests/bug64609.phpt                |  2 +-
+ ext/pgsql/tests/bug68638.phpt                |  2 +-
+ 8 files changed, 82 insertions(+), 11 deletions(-)
+ create mode 100644 ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt
+
+diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
+index e9a68a8555..4cffeb31d6 100644
+--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
+@@ -4562,7 +4562,6 @@ static int php_pgsql_add_quotes(zval *src, zend_bool should_free)
+ 	assert(Z_TYPE_P(src) == IS_STRING);
+ 	assert(should_free == 1 || should_free == 0);
+ 
+-	smart_str_appendc(&str, 'E');
+ 	smart_str_appendc(&str, '\'');
+ 	smart_str_appendl(&str, Z_STRVAL_P(src), Z_STRLEN_P(src));
+ 	smart_str_appendc(&str, '\'');
+@@ -4852,8 +4851,8 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
+ 							zend_string *str;
+ 							/* PostgreSQL ignores \0 */
+ 							str = zend_string_alloc(Z_STRLEN_P(val) * 2, 0);
+-							/* better to use PGSQLescapeLiteral since PGescapeStringConn does not handle special \ */
+-							ZSTR_LEN(str) = PQescapeStringConn(pg_link, ZSTR_VAL(str), Z_STRVAL_P(val), Z_STRLEN_P(val), &escape_err);
+							ZSTR_LEN(str) = PQescapeStringConn(pg_link, ZSTR_VAL(str),
+									Z_STRVAL_P(val), Z_STRLEN_P(val), &escape_err);
+ 							if (escape_err) {
+ 								err = 1;
+ 							} else {
+diff --git a/ext/pgsql/tests/10pg_convert_9.phpt b/ext/pgsql/tests/10pg_convert_9.phpt
+index 0a2828a247..8a2c3cd972 100644
+--- a/ext/pgsql/tests/10pg_convert_9.phpt
+++ b/ext/pgsql/tests/10pg_convert_9.phpt
+@@ -19,6 +19,8 @@ $converted = pg_convert($db, $table_name, $fields);
+ 
+ var_dump($converted);
+ 
+var_dump(pg_convert($db, $table_name, ['str' => "\\' OR 1=1"]));
+
+ /* Invalid values */
+ try {
+     $converted = pg_convert($db, $table_name, [5 => 'AAA']);
+@@ -46,18 +48,30 @@ try {
+ } catch (\TypeError $e) {
+     echo $e->getMessage(), \PHP_EOL;
+ }
+
+/* standard_conforming_strings = 1 */
+pg_query($db, "SET standard_conforming_strings = 1");
+var_dump(pg_convert($db, $table_name, ['str' => "\\' OR 1=1"]));
+ ?>
+ --EXPECT--
+ array(3) {
+   [""num""]=>
+   string(4) "1234"
+   [""str""]=>
+-  string(6) "E'AAA'"
+  string(5) "'AAA'"
+   [""bin""]=>
+-  string(12) "E'\\x424242'"
+  string(11) "'\\x424242'"
+}
+array(1) {
+  [""str""]=>
+  string(13) "'\\'' OR 1=1'"
+ }
+ Array of values must be an associative array with string keys
+ Array of values must be an associative array with string keys
+ Values must be of type string|int|float|bool|null, array given
+ Values must be of type string|int|float|bool|null, stdClass given
+ Values must be of type string|int|float|bool|null, resource given
+array(1) {
+  [""str""]=>
+  string(12) "'\'' OR 1=1'"
+}
+diff --git a/ext/pgsql/tests/10pg_convert_json_array.phpt b/ext/pgsql/tests/10pg_convert_json_array.phpt
+index 46aec3ffbc..7f51cb003f 100644
+--- a/ext/pgsql/tests/10pg_convert_json_array.phpt
+++ b/ext/pgsql/tests/10pg_convert_json_array.phpt
+@@ -30,8 +30,8 @@ if (!pg_insert($db, $table_name_92, $fields)) {
+ --EXPECT--
+ array(2) {
+   [""textary""]=>
+-  string(51) "E'{"meeting", "lunch", "training", "presentation"}'"
+  string(50) "'{"meeting", "lunch", "training", "presentation"}'"
+   [""jsn""]=>
+-  string(22) "E'{"f1":1,"f2":"foo"}'"
+  string(21) "'{"f1":1,"f2":"foo"}'"
+ }
+ OK
+diff --git a/ext/pgsql/tests/12pg_insert_9.phpt b/ext/pgsql/tests/12pg_insert_9.phpt
+index 11a401f358..f0e2e623ec 100644
+--- a/ext/pgsql/tests/12pg_insert_9.phpt
+++ b/ext/pgsql/tests/12pg_insert_9.phpt
+@@ -52,7 +52,7 @@ try {
+ echo "Ok\n";
+ ?>
+ --EXPECTF--
+-INSERT INTO "php_pgsql_test" ("num","str","bin") VALUES (1234,E'AAA',E'\\x424242');
+INSERT INTO "php_pgsql_test" ("num","str","bin") VALUES (1234,'AAA','\\x424242');
+ INSERT INTO "php_pgsql_test" ("num","str","bin") VALUES ('1234','AAA','BBB');
+ resource(%d) of type (pgsql result)
+ Array of values must be an associative array with string keys
+diff --git a/ext/pgsql/tests/14pg_update_9.phpt b/ext/pgsql/tests/14pg_update_9.phpt
+index e3e802b7a2..1e2ae37227 100644
+--- a/ext/pgsql/tests/14pg_update_9.phpt
+++ b/ext/pgsql/tests/14pg_update_9.phpt
+@@ -24,6 +24,6 @@ echo pg_update($db, $table_name, $fields, $ids, PGSQL_DML_STRING|PGSQL_DML_ESCAP
+ echo "Ok\n";
+ ?>
+ --EXPECT--
+-UPDATE "php_pgsql_test" SET "num"=1234,"str"=E'ABC',"bin"=E'\\x58595a' WHERE "num"=1234;
+UPDATE "php_pgsql_test" SET "num"=1234,"str"='ABC',"bin"='\\x58595a' WHERE "num"=1234;
+ UPDATE "php_pgsql_test" SET "num"='1234',"str"='ABC',"bin"='XYZ' WHERE "num"='1234';
+ Ok
+diff --git a/ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt b/ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt
+new file mode 100644
+index 0000000000..88b37a8432
+--- /dev/null
+++ b/ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt
+@@ -0,0 +1,58 @@
+--TEST--
+GHSA-7qpv-r5mr-78m4: SQL injection via E'...' backslash breakout
+--CREDITS--
+expatch.llc
+--EXTENSIONS--
+pgsql
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+include 'config.inc';
+
+$db = pg_connect($conn_str);
+
+pg_query($db, "SET standard_conforming_strings = 1");
+
+pg_query($db, "DROP TABLE IF EXISTS ghsa_7qpv_r5mr_78m4");
+pg_query($db, "CREATE TABLE ghsa_7qpv_r5mr_78m4 (id serial primary key, name text, admin boolean)");
+pg_query($db, "INSERT INTO ghsa_7qpv_r5mr_78m4 (name, admin) VALUES ('alice', false), ('bob', false)");
+
+$params = ['name' => "zzz' OR 1=1 --"];
+echo pg_select($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_STRING) . "\n";
+printf("returned: %d\n\n", count(pg_select($db, 'ghsa_7qpv_r5mr_78m4', $params)));
+
+$params = ['name' => "zzz\\' OR 1=1 --"];
+echo pg_select($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_STRING) . "\n";
+printf("returned: %d\n\n", count(pg_select($db, 'ghsa_7qpv_r5mr_78m4', $params)));
+
+$params = ['name' => "john\\', true) --", 'admin' => 'false'];
+echo pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_STRING) . "\n";
+pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params);
+var_dump(pg_select($db, 'ghsa_7qpv_r5mr_78m4', ['id' => 3])[0]['admin']);
+echo "\n";
+
+$params = ['name' => "jake\\', true) --", 'admin' => 'f'];
+echo pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_ESCAPE|PGSQL_DML_STRING) . "\n";
+pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_EXEC|PGSQL_DML_ESCAPE);
+var_dump(pg_select($db, 'ghsa_7qpv_r5mr_78m4', ['id' => 4])[0]['admin']);
+
+?>
+--EXPECT--
+SELECT * FROM "ghsa_7qpv_r5mr_78m4" WHERE "name"='zzz'' OR 1=1 --';
+returned: 0
+
+SELECT * FROM "ghsa_7qpv_r5mr_78m4" WHERE "name"='zzz\'' OR 1=1 --';
+returned: 0
+
+INSERT INTO "ghsa_7qpv_r5mr_78m4" ("name","admin") VALUES ('john\'', true) --','f');
+string(1) "f"
+
+INSERT INTO "ghsa_7qpv_r5mr_78m4" ("name","admin") VALUES ('jake\'', true) --','f');
+string(1) "f"
+--CLEAN--
+<?php
+include('config.inc');
+$db = pg_connect($conn_str);
+pg_query($db, "DROP TABLE IF EXISTS ghsa_7qpv_r5mr_78m4");
+?>
+diff --git a/ext/pgsql/tests/bug64609.phpt b/ext/pgsql/tests/bug64609.phpt
+index e31ec8e019..03cee4aeca 100644
+--- a/ext/pgsql/tests/bug64609.phpt
+++ b/ext/pgsql/tests/bug64609.phpt
+@@ -26,5 +26,5 @@ var_dump($converted);
+ --EXPECT--
+ array(1) {
+   [""a""]=>
+-  string(5) "E'ok'"
+  string(4) "'ok'"
+ }
+diff --git a/ext/pgsql/tests/bug68638.phpt b/ext/pgsql/tests/bug68638.phpt
+index e0701a79f5..336438c86b 100644
+--- a/ext/pgsql/tests/bug68638.phpt
+++ b/ext/pgsql/tests/bug68638.phpt
+@@ -32,7 +32,7 @@ pg_query("DROP TABLE $table");
+ 
+ ?>
+ --EXPECT--
+-string(52) "UPDATE "test_68638" SET "value"=E'inf' WHERE "id"=1;"
+string(51) "UPDATE "test_68638" SET "value"='inf' WHERE "id"=1;"
+ array(2) {
+   ["id"]=>
+   string(1) "1"
+-- 
+2.55.0
+
--- a/php-cve2026-7260.patch
+++ b/php-cve2026-7260.patch
@ -0,0 +1,102 @@
+From 8.2.33, without binary diffs
+
+
+From 92458605f7f88697973e1183b46296d4c9bf9c46 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka@php.net>
+Date: Sun, 3 May 2026 19:26:31 +0200
+Subject: [PATCH 3/5] Fix GHSA-vc5h-9ppw-p5f3: phar circular symlink crash
+
+Prevents infinite recursion in phar_get_link_source.
+
+(cherry picked from commit 2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52)
+(cherry picked from commit c84ffef248fddba29bde47847bd4cd06761e0aab)
+---
+ .../tests/tar/files/circular_symlinks.tar     | Bin 0 -> 10240 bytes
+ .../tar/files/circular_symlinks_long.tar      | Bin 0 -> 215040 bytes
+ .../tests/tar/files/circular_symlinks_rho.tar | Bin 0 -> 10240 bytes
+ .../ghsa-vc5h-9ppw-p5f3-symlink-circular.phpt |  27 ++++++++++
+ ext/phar/util.c                               |  51 ++++++++++++++----
+ 5 files changed, 67 insertions(+), 11 deletions(-)
+ create mode 100644 ext/phar/tests/tar/files/circular_symlinks.tar
+ create mode 100644 ext/phar/tests/tar/files/circular_symlinks_long.tar
+ create mode 100644 ext/phar/tests/tar/files/circular_symlinks_rho.tar
+ create mode 100644 ext/phar/tests/tar/ghsa-vc5h-9ppw-p5f3-symlink-circular.phpt
+
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+index 59362bbc72..d49ea9bfc5 100644
+--- a/ext/phar/util.c
+++ b/ext/phar/util.c
+@@ -57,30 +57,59 @@ static char *phar_get_link_location(phar_entry_info *entry) /* {{{ */
+ }
+ /* }}} */
+ 
+-phar_entry_info *phar_get_link_source(phar_entry_info *entry) /* {{{ */
+static phar_entry_info *phar_follow_one_link(phar_entry_info *entry)
+ {
+ 	phar_entry_info *link_entry;
+ 	char *link;
+ 
+-	if (!entry->link) {
+-		return entry;
+-	}
+-
+ 	link = phar_get_link_location(entry);
+ 	if (NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), entry->link, strlen(entry->link))) ||
+ 		NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), link, strlen(link)))) {
+ 		if (link != entry->link) {
+ 			efree(link);
+ 		}
+-		return phar_get_link_source(link_entry);
+-	} else {
+-		if (link != entry->link) {
+-			efree(link);
+		return link_entry;
+	}
+
+	if (link != entry->link) {
+		efree(link);
+	}
+	return NULL;
+}
+
+phar_entry_info *phar_get_link_source(phar_entry_info *entry)
+{
+	phar_entry_info *slow, *fast;
+
+	if (!entry->link) {
+		return entry;
+	}
+
+	/*
+	 * Use Floyd's cycle detection algorithm to follow the symlink chain without unbounded
+	 * recursion. Each entry has at most one outgoing link, so if a cycle exists the fast pointer
+	 * will eventually meet the slow one. Otherwise the fast pointer reaches the end first.
+	 */
+	slow = fast = entry;
+	while (1) {
+		fast = phar_follow_one_link(fast);
+		if (!fast || !fast->link) {
+			return fast;
+		}
+		fast = phar_follow_one_link(fast);
+		if (!fast || !fast->link) {
+			return fast;
+		}
+
+		/* no need to check slow as it's always behind */
+		slow = phar_follow_one_link(slow);
+
+		if (slow == fast) {
+			/* circular symlink chain */
+			return NULL;
+ 		}
+-		return NULL;
+ 	}
+ }
+-/* }}} */
+ 
+ /* retrieve a phar_entry_info's current file pointer for reading contents */
+ php_stream *phar_get_efp(phar_entry_info *entry, int follow_links) /* {{{ */
+-- 
+2.55.0
+
--- a/php-cve2026-9672.patch
+++ b/php-cve2026-9672.patch
@ -0,0 +1,47 @@
+From 3d3d3d57c590a498b0939e78df64a1a5dbac17bc Mon Sep 17 00:00:00 2001
+From: Ilija Tovilo <ilija.tovilo@me.com>
+Date: Tue, 28 Jul 2026 02:48:11 +0200
+Subject: [PATCH 1/5] libgd patch for CVE-2026-9672
+
+Patch by Pierre Joye (pierrejoye).
+
+(cherry picked from commit fcd691b377d02285740744bee17c0f298be227d5)
+(cherry picked from commit 629e049847acec53b905b4aceba829a0c85f0995)
+---
+ ext/gd/libgd/gd_gif_in.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
+index 1f69723610..e055f90244 100644
+--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
+@@ -450,7 +450,7 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
+ 			sd->table[1][i] = i;
+ 		}
+ 		for (; i < (1<<MAX_LWZ_BITS); ++i)
+-			sd->table[0][i] = sd->table[1][0] = 0;
+			sd->table[0][i] = sd->table[1][i] = 0;
+ 
+ 		sd->sp = sd->stack;
+ 
+@@ -494,6 +494,8 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
+ 
+ 			if (count != 0)
+ 				return -2;
+
+			return -2;
+ 		}
+ 
+ 		incode = code;
+@@ -560,7 +562,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
+ 	int             v;
+ 	int             xpos = 0, ypos = 0, pass = 0;
+ 	int i;
+-	LZW_STATIC_DATA sd;
+	LZW_STATIC_DATA sd = {0};
+ 
+ 
+ 	/*
+-- 
+2.55.0
+
--- a/php-gh22643.patch
+++ b/php-gh22643.patch
@ -0,0 +1,136 @@
+From 3f74c8a960c866da1b016bac2fc9e476955fbbc7 Mon Sep 17 00:00:00 2001
+From: Ilija Tovilo <ilija.tovilo@me.com>
+Date: Tue, 7 Jul 2026 20:32:58 +0200
+Subject: [PATCH 4/5] Fix leak on double DatePeriod::__construct() call
+
+Closes GH-22643
+
+(cherry picked from commit 2d86f8cf489ea5410edd19d301c1aefe330599ab)
+(cherry picked from commit 591e613e1cf6cc10d84df2c799ede593b7371bc1)
+---
+ NEWS                                          |  5 +++++
+ ext/date/php_date.c                           | 21 ++++++++++++++++++-
+ .../DatePeriod_double_constructor_call.phpt   | 14 +++++++++++++
+ 3 files changed, 39 insertions(+), 1 deletion(-)
+ create mode 100644 ext/date/tests/DatePeriod_double_constructor_call.phpt
+
+diff --git a/NEWS b/NEWS
+index e3cb991135..b7b43af995 100644
+--- a/NEWS
+++ b/NEWS
+@@ -1,6 +1,11 @@
+ PHP                                                                        NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+ 
+Backported from 8.2.33
+
+- Date:
+  . Fixed leak on double DatePeriod::__construct() call. (ilutov)
+
+ Backported from 8.2.32
+ 
+ - OpenSSL:
+diff --git a/ext/date/php_date.c b/ext/date/php_date.c
+index 082b475e43..b340eb76dd 100644
+--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
+@@ -4185,6 +4185,23 @@ static int date_period_initialize(timelib_time **st, timelib_time **et, timelib_
+ 	return retval;
+ } /* }}} */
+ 
+static void date_period_reset(php_period_obj *period_obj)
+{
+	if (period_obj->start) {
+		timelib_time_dtor(period_obj->start);
+	}
+	if (period_obj->current) {
+		timelib_time_dtor(period_obj->current);
+	}
+	if (period_obj->end) {
+		timelib_time_dtor(period_obj->end);
+	}
+	if (period_obj->interval) {
+		timelib_rel_time_dtor(period_obj->interval);
+	}
+	memset(period_obj, 0, XtOffsetOf(php_period_obj, std));
+}
+
+ /* {{{ Creates new DatePeriod object. */
+ PHP_METHOD(DatePeriod, __construct)
+ {
+@@ -4207,7 +4224,7 @@ PHP_METHOD(DatePeriod, __construct)
+ 	}
+ 
+ 	dpobj = Z_PHPPERIOD_P(ZEND_THIS);
+-	dpobj->current = NULL;
+	date_period_reset(dpobj);
+ 
+ 	if (isostr) {
+ 		zend_replace_error_handling(EH_THROW, NULL, &error_handling);
+@@ -4244,6 +4261,8 @@ PHP_METHOD(DatePeriod, __construct)
+ 		}
+ 		dpobj->start_ce = date_ce_date;
+ 	} else {
+		DATE_CHECK_INITIALIZED(Z_PHPINTERVAL_P(interval)->initialized, Z_OBJCE_P(interval));
+
+ 		/* init */
+ 		php_interval_obj *intobj = Z_PHPINTERVAL_P(interval);
+ 
+diff --git a/ext/date/tests/DatePeriod_double_constructor_call.phpt b/ext/date/tests/DatePeriod_double_constructor_call.phpt
+new file mode 100644
+index 0000000000..551d272728
+--- /dev/null
+++ b/ext/date/tests/DatePeriod_double_constructor_call.phpt
+@@ -0,0 +1,14 @@
+--TEST--
+Double DatePeriod::__construct() call
+--FILE--
+<?php
+
+$start = new \DateTime();
+$interval = new \DateInterval('P1D');
+$period = new \DatePeriod($start, $interval, 1);
+$period->__construct($start, $interval, 1);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
+-- 
+2.55.0
+
+From 9aa1f1c43308560bb5dc97cbf8995c66108aeef0 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Thu, 30 Jul 2026 09:07:49 +0200
+Subject: [PATCH 5/5] NEWS from 8.2.33
+
+(cherry picked from commit 11b947ce14c7fcc77adc740349add4c5c8967a62)
+---
+ NEWS | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/NEWS b/NEWS
+index b7b43af995..cffb061d76 100644
+--- a/NEWS
+++ b/NEWS
+@@ -6,6 +6,17 @@ Backported from 8.2.33
+ - Date:
+   . Fixed leak on double DatePeriod::__construct() call. (ilutov)
+ 
+- GD:
+  . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
+
+- PGSQL:
+  . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
+    (CVE-2026-17543) (ilutov)
+
+- Phar:
+  . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
+    (Jakub Zelenka)
+
+ Backported from 8.2.32
+ 
+ - OpenSSL:
+-- 
+2.55.0
+
--- a/php.spec
+++ b/php.spec
@ -62,7 +62,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 7%{?dist}
+Release: 8%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@ -162,8 +162,13 @@ Patch228: php-cve-2026-6735.patch
 Patch229: php-cve-2026-7259.patch
 Patch230: php-cve-2026-7568.patch
 Patch231: php-cve-2026-7258.patch
-# from 8.2.32
+# From 8.2.32
 Patch232: php-cve-2026-14355.patch
+# From 8.2.33
+Patch233: php-cve2026-9672.patch
+Patch234: php-cve2026-17543.patch
+Patch235: php-cve2026-7260.patch
+Patch236: php-gh22643.patch

 # Fixes for tests (300+)
 # Factory is droped from system tzdata
@ -801,6 +806,10 @@ rm ext/openssl/tests/p12_with_extra_certs.p12
 %patch -P230 -p1 -b .cve7268
 %patch -P231 -p1 -b .cve7258
 %patch -P232 -p1 -b .cve14355
+%patch -P233 -p1 -b .cve9672
+%patch -P234 -p1 -b .cve17543
+%patch -P235 -p1 -b .cve7260
+%patch -P236 -p1 -b .gh22643

 # Fixes for tests
 %patch -P300 -p1 -b .datetests
@ -1609,6 +1618,13 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :


 %changelog
+* Tue Aug  4 2026 Remi Collet <rcollet@redhat.com> - 8.0.30-8
+- Fix leak on double DatePeriod::__construct() call
+- Fixed SQL injection via E'...' backslash breakout
+  CVE-2026-17543
+- Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks
+  CVE-2026-7260
+
 * Thu Jul  9 2026 Remi Collet <rcollet@redhat.com> - 8.0.30-7
 - Fix Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
  CVE-2026-14355