CVE-2026-7258: fix signed-char passing to ctype.h functions in urldecode
and url parsing (GHSA-m8rr-4c36-8gq4)
CVE-2026-7262: fix NULL check in to_zval_map() using wrong variable xmlKey
instead of xmlValue, causing crash in SOAP typemap decoding (GHSA-hmxp-6pc4-f3vv)
CVE-2026-7568: fix signed integer overflow in metaphone() by switching
w_idx/idx/how_far from int to size_t in ext/standard/metaphone.c