[php-src] PHP-8.5.9: Add NEWS entries

Author: Ilija Tovilo (iluuu1994)
Pusher: edorian
Date: 2026-07-28T11:35:03+02:00

Commit: https://github.com/php/php-src/commit/43d4b695fd314f98860a4623453a2f9ebf01937b
Raw diff: https://github.com/php/php-src/commit/43d4b695fd314f98860a4623453a2f9ebf01937b.diff

Add NEWS entries

Changed paths:
  M  NEWS


Diff:

diff --git a/NEWS b/NEWS
index 7e138fcc2bb1..e8c0922afb28 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Lock unmodified readonly properties for modification after clone-with.
     (NickSdot)
 
+- BCMath:
+  . Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()).
+    (CVE-2026-17544) (Recep Asan)
+
 - Calendar:
   . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
     INT_MAX year). (arshidkv12)
@@ -36,6 +40,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size"
     warning when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)
 
+- GD:
+  . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
+
 - Hash:
   . Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc
     alignment). (iliaal)
@@ -77,12 +84,18 @@ PHP                                                                        NEWS
   . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
     diagnostic message length beyond the error buffer). (iliaal)
 
+- PGSQL:
+  . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
+    (CVE-2026-17543) (ilutov)
+
 - Phar:
   . Fixed inconsistent handling of the magic ".phar" directory. Paths such as
     "/.phar" remain protected, while non-magic paths that merely start with
     ".phar" are handled consistently across file and directory creation,
     copying, ArrayAccess, stream lookup, directory iteration and extraction.
     (Weilin Du)
+  . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
+    (Jakub Zelenka)
 
 - PHPDBG:
   . Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
@@ -108,7 +121,7 @@ PHP                                                                        NEWS
     PHP 8.3 and PHP 8.5). (jorgsowa)
 
 - SPL:
-  . Fix	class_parents for classes with leading slash in non-autoload mode.                                                                     
+  . Fix	class_parents for classes with leading slash in non-autoload mode.
     (jorgsowa)
   . Ignore leading back-slash in class_parents(), class_implements(), and
     class_uses(). (jorgsowa)