CVE-2026-17543: fix SQL injection in ext/pgsql via E'...' backslash breakout in
php_pgsql_add_quotes() (GHSA-7qpv-r5mr-78m4)
CVE-2026-7260: fix stack exhaustion from circular symlinks in phar archives by
replacing recursion in phar_get_link_source() with cycle detection (GHSA-vc5h-9ppw-p5f3)