diff -Nru php8.4-8.4.10/configure php8.4-8.4.11/configure
--- php8.4-8.4.10/configure	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/configure	2025-07-29 17:30:21.000000000 +0200
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.72 for PHP 8.4.10.
+# Generated by GNU Autoconf 2.72 for PHP 8.4.11.
 #
 # Report bugs to <https://github.com/php/php-src/issues>.
 #
@@ -816,8 +816,8 @@
 # Identity of this package.
 PACKAGE_NAME='PHP'
 PACKAGE_TARNAME='php'
-PACKAGE_VERSION='8.4.10'
-PACKAGE_STRING='PHP 8.4.10'
+PACKAGE_VERSION='8.4.11'
+PACKAGE_STRING='PHP 8.4.11'
 PACKAGE_BUGREPORT='https://github.com/php/php-src/issues'
 PACKAGE_URL='https://www.php.net'
 
@@ -1872,7 +1872,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-'configure' configures PHP 8.4.10 to adapt to many kinds of systems.
+'configure' configures PHP 8.4.11 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1944,7 +1944,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of PHP 8.4.10:";;
+     short | recursive ) echo "Configuration of PHP 8.4.11:";;
    esac
   cat <<\_ACEOF
 
@@ -2449,7 +2449,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-PHP configure 8.4.10
+PHP configure 8.4.11
 generated by GNU Autoconf 2.72
 
 Copyright (C) 2023 Free Software Foundation, Inc.
@@ -3206,7 +3206,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by PHP $as_me 8.4.10, which was
+It was created by PHP $as_me 8.4.11, which was
 generated by GNU Autoconf 2.72.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -4628,7 +4628,7 @@
 
 
 ac_IFS=$IFS; IFS="."
-set $(echo 8.4.10 | "${SED}" 's/\([0-9\.]*\)\(.*\)/\1\.\2/')
+set $(echo 8.4.11 | "${SED}" 's/\([0-9\.]*\)\(.*\)/\1\.\2/')
 IFS=$ac_IFS
 PHP_MAJOR_VERSION=$1
 PHP_MINOR_VERSION=$2
@@ -93637,7 +93637,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by PHP $as_me 8.4.10, which was
+This file was extended by PHP $as_me 8.4.11, which was
 generated by GNU Autoconf 2.72.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -93706,7 +93706,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-PHP config.status 8.4.10
+PHP config.status 8.4.11
 configured by $0, generated by GNU Autoconf 2.72,
   with options \\"\$ac_cs_config\\"
 
diff -Nru php8.4-8.4.10/configure.ac php8.4-8.4.11/configure.ac
--- php8.4-8.4.10/configure.ac	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/configure.ac	2025-07-29 17:30:21.000000000 +0200
@@ -17,7 +17,7 @@
 dnl ----------------------------------------------------------------------------
 
 AC_PREREQ([2.68])
-AC_INIT([PHP],[8.4.10],[https://github.com/php/php-src/issues],[php],[https://www.php.net])
+AC_INIT([PHP],[8.4.11],[https://github.com/php/php-src/issues],[php],[https://www.php.net])
 AC_CONFIG_SRCDIR([main/php_version.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PRESERVE_HELP_ORDER
diff -Nru php8.4-8.4.10/debian/changelog php8.4-8.4.11/debian/changelog
--- php8.4-8.4.10/debian/changelog	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/changelog	2025-08-03 09:32:21.000000000 +0200
@@ -1,3 +1,9 @@
+php8.4 (8.4.11-1) unstable; urgency=medium
+
+  * New upstream version 8.4.11
+
+ -- Ondřej Surý <ondrej@debian.org>  Sun, 03 Aug 2025 09:32:21 +0200
+
 php8.4 (8.4.10-1) unstable; urgency=medium
 
   * Set PHP_BUILD_PROVIDER to Debian with option to override this from
diff -Nru php8.4-8.4.10/debian/patches/0001-libtool_fixes.patch php8.4-8.4.11/debian/patches/0001-libtool_fixes.patch
--- php8.4-8.4.10/debian/patches/0001-libtool_fixes.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0001-libtool_fixes.patch	2025-08-03 09:32:21.000000000 +0200
@@ -7,7 +7,7 @@
  1 file changed, 2 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 13e59c2..06a9b8f 100644
+index 49d7ffe..8b42844 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1573,8 +1573,6 @@ AC_PROVIDE_IFELSE([PHP_REQUIRE_CXX], [], [
diff -Nru php8.4-8.4.10/debian/patches/0002-debian_quirks.patch php8.4-8.4.11/debian/patches/0002-debian_quirks.patch
--- php8.4-8.4.10/debian/patches/0002-debian_quirks.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0002-debian_quirks.patch	2025-08-03 09:32:21.000000000 +0200
@@ -13,7 +13,7 @@
  7 files changed, 20 insertions(+), 15 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 06a9b8f..c4e18a3 100644
+index 8b42844..b3572d2 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1130,7 +1130,7 @@ AS_VAR_IF([PHP_CLI], [no], [with_pear=no])
diff -Nru php8.4-8.4.10/debian/patches/0004-extension_api.patch php8.4-8.4.11/debian/patches/0004-extension_api.patch
--- php8.4-8.4.10/debian/patches/0004-extension_api.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0004-extension_api.patch	2025-08-03 09:32:21.000000000 +0200
@@ -8,7 +8,7 @@
  2 files changed, 8 insertions(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index c4e18a3..4df6691 100644
+index b3572d2..1ade7e7 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1327,12 +1327,14 @@ ZEND_MODULE_API_NO=$($EGREP '#define ZEND_MODULE_API_NO ' $srcdir/Zend/zend_modu
diff -Nru php8.4-8.4.10/debian/patches/0023-php-5.4.9-fixheader.patch php8.4-8.4.11/debian/patches/0023-php-5.4.9-fixheader.patch
--- php8.4-8.4.10/debian/patches/0023-php-5.4.9-fixheader.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0023-php-5.4.9-fixheader.patch	2025-08-03 09:32:21.000000000 +0200
@@ -8,7 +8,7 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 4df6691..0e158a1 100644
+index 1ade7e7..6b0d761 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1398,8 +1398,8 @@ EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $PHP_LDFLAGS"
diff -Nru php8.4-8.4.10/debian/patches/0028-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch php8.4-8.4.11/debian/patches/0028-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
--- php8.4-8.4.10/debian/patches/0028-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0028-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch	2025-08-03 09:32:21.000000000 +0200
@@ -7,7 +7,7 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 0e158a1..b79b591 100644
+index 6b0d761..fc7f49e 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1358,9 +1358,9 @@ EXPANDED_LOCALSTATEDIR=$(eval echo $localstatedir)
diff -Nru php8.4-8.4.10/debian/patches/0037-Lower-the-OpenSSL-requirement-to-1.0.1.patch php8.4-8.4.11/debian/patches/0037-Lower-the-OpenSSL-requirement-to-1.0.1.patch
--- php8.4-8.4.10/debian/patches/0037-Lower-the-OpenSSL-requirement-to-1.0.1.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0037-Lower-the-OpenSSL-requirement-to-1.0.1.patch	2025-08-03 09:32:21.000000000 +0200
@@ -79,7 +79,7 @@
  #elif OPENSSL_VERSION_NUMBER < 0x30200000L
  #define PHP_OPENSSL_API_VERSION 0x30000
 diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c
-index d4f162b..44e84db 100644
+index ec41379..ebc8313 100644
 --- a/ext/openssl/xp_ssl.c
 +++ b/ext/openssl/xp_ssl.c
 @@ -33,8 +33,11 @@
diff -Nru php8.4-8.4.10/debian/patches/0038-Override-result-of-AC_PROG_LN_S-to-fix-FTBFS-on-ppc6.patch php8.4-8.4.11/debian/patches/0038-Override-result-of-AC_PROG_LN_S-to-fix-FTBFS-on-ppc6.patch
--- php8.4-8.4.10/debian/patches/0038-Override-result-of-AC_PROG_LN_S-to-fix-FTBFS-on-ppc6.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0038-Override-result-of-AC_PROG_LN_S-to-fix-FTBFS-on-ppc6.patch	2025-08-03 09:32:21.000000000 +0200
@@ -7,7 +7,7 @@
  1 file changed, 5 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index b79b591..a55b95a 100644
+index fc7f49e..cfc1305 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -122,6 +122,11 @@ AC_PROG_CPP
diff -Nru php8.4-8.4.10/debian/patches/0041-Remove-timestamps-from-phar.patch php8.4-8.4.11/debian/patches/0041-Remove-timestamps-from-phar.patch
--- php8.4-8.4.10/debian/patches/0041-Remove-timestamps-from-phar.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0041-Remove-timestamps-from-phar.patch	2025-08-03 09:32:21.000000000 +0200
@@ -11,7 +11,7 @@
  2 files changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/ext/phar/phar.c b/ext/phar/phar.c
-index 4d8710b..3d42d93 100644
+index 7650478..f807094 100644
 --- a/ext/phar/phar.c
 +++ b/ext/phar/phar.c
 @@ -2965,7 +2965,7 @@ void phar_flush_ex(phar_archive_data *phar, zend_string *user_stub, bool is_defa
diff -Nru php8.4-8.4.10/debian/patches/0046-Add-enable-rtld-deepbind-configure-flag.patch php8.4-8.4.11/debian/patches/0046-Add-enable-rtld-deepbind-configure-flag.patch
--- php8.4-8.4.10/debian/patches/0046-Add-enable-rtld-deepbind-configure-flag.patch	2025-07-03 14:35:27.000000000 +0200
+++ php8.4-8.4.11/debian/patches/0046-Add-enable-rtld-deepbind-configure-flag.patch	2025-08-03 09:32:21.000000000 +0200
@@ -21,7 +21,7 @@
  # else
  #  define DL_LOAD(libname)			dlopen(libname, PHP_RTLD_MODE | RTLD_GLOBAL)
 diff --git a/configure.ac b/configure.ac
-index a55b95a..0b43326 100644
+index cfc1305..38d4fca 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -867,6 +867,23 @@ AS_VAR_IF([PHP_RTLD_NOW], [yes],
diff -Nru php8.4-8.4.10/ext/calendar/calendar.c php8.4-8.4.11/ext/calendar/calendar.c
--- php8.4-8.4.10/ext/calendar/calendar.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/calendar/calendar.c	2025-07-29 17:30:21.000000000 +0200
@@ -490,6 +490,11 @@
 		RETURN_THROWS();
 	}
 
+	if (ZEND_LONG_EXCEEDS_INT(year)) {
+		zend_argument_value_error(3, "must be between %d and %d", INT_MIN, INT_MAX);
+		RETURN_THROWS();
+	}
+
 	RETURN_LONG(JewishToSdn(year, month, day));
 }
 /* }}} */
diff -Nru php8.4-8.4.10/ext/calendar/jewish.c php8.4-8.4.11/ext/calendar/jewish.c
--- php8.4-8.4.10/ext/calendar/jewish.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/calendar/jewish.c	2025-07-29 17:30:21.000000000 +0200
@@ -710,7 +710,7 @@
 	int yearLength;
 	int lengthOfAdarIAndII;
 
-	if (year <= 0 || day <= 0 || day > 30) {
+	if (year <= 0 || year >= 6000 || day <= 0 || day > 30) {
 		return (0);
 	}
 	switch (month) {
diff -Nru php8.4-8.4.10/ext/calendar/tests/gh16234_2_64.phpt php8.4-8.4.11/ext/calendar/tests/gh16234_2_64.phpt
--- php8.4-8.4.10/ext/calendar/tests/gh16234_2_64.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/calendar/tests/gh16234_2_64.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,21 @@
+--TEST--
+GH-16234 jewishtojd overflow on year argument
+--EXTENSIONS--
+calendar
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE == 4) {
+        die("skip this test is for 64bit platform only");
+}
+?>
+--FILE--
+<?php
+try {
+	jewishtojd(10, 6, PHP_INT_MIN);
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+?>
+--EXPECTF--
+jewishtojd(): Argument #3 ($year) must be between %i and %d
+
diff -Nru php8.4-8.4.10/ext/calendar/tests/gh16234_2.phpt php8.4-8.4.11/ext/calendar/tests/gh16234_2.phpt
--- php8.4-8.4.10/ext/calendar/tests/gh16234_2.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/calendar/tests/gh16234_2.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,11 @@
+--TEST--
+GH-16234 jewishtojd overflow on year argument
+--EXTENSIONS--
+calendar
+--FILE--
+<?php
+jewishtojd(10, 6, 2147483647);
+echo "DONE";
+?>
+--EXPECTF--
+DONE
diff -Nru php8.4-8.4.10/ext/curl/curl_private.h php8.4-8.4.11/ext/curl/curl_private.h
--- php8.4-8.4.10/ext/curl/curl_private.h	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/curl/curl_private.h	2025-07-29 17:30:21.000000000 +0200
@@ -139,6 +139,9 @@
 void _php_curl_verify_handlers(php_curl *ch, bool reporterror);
 void _php_setup_easy_copy_handlers(php_curl *ch, php_curl *source);
 
+/* Consumes `zv` */
+zend_long php_curl_get_long(zval *zv);
+
 static inline php_curl *curl_from_obj(zend_object *obj) {
 	return (php_curl *)((char *)(obj) - XtOffsetOf(php_curl, std));
 }
diff -Nru php8.4-8.4.10/ext/curl/interface.c php8.4-8.4.11/ext/curl/interface.c
--- php8.4-8.4.10/ext/curl/interface.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/curl/interface.c	2025-07-29 17:30:21.000000000 +0200
@@ -600,7 +600,7 @@
 			if (!Z_ISUNDEF(retval)) {
 				_php_curl_verify_handlers(ch, /* reporterror */ true);
 				/* TODO Check callback returns an int or something castable to int */
-				length = zval_get_long(&retval);
+				length = php_curl_get_long(&retval);
 			}
 
 			zval_ptr_dtor(&argv[0]);
@@ -633,7 +633,7 @@
 	if (!Z_ISUNDEF(retval)) {
 		_php_curl_verify_handlers(ch, /* reporterror */ true);
 		/* TODO Check callback returns an int or something castable to int */
-		rval = zval_get_long(&retval);
+		rval = php_curl_get_long(&retval);
 	}
 	zval_ptr_dtor(&argv[0]);
 	zval_ptr_dtor(&argv[1]);
@@ -670,7 +670,7 @@
 	if (!Z_ISUNDEF(retval)) {
 		_php_curl_verify_handlers(ch, /* reporterror */ true);
 		/* TODO Check callback returns an int or something castable to int */
-		if (0 != zval_get_long(&retval)) {
+		if (0 != php_curl_get_long(&retval)) {
 			rval = 1;
 		}
 	}
@@ -708,7 +708,7 @@
 	if (!Z_ISUNDEF(retval)) {
 		_php_curl_verify_handlers(ch, /* reporterror */ true);
 		/* TODO Check callback returns an int or something castable to int */
-		if (0 != zval_get_long(&retval)) {
+		if (0 != php_curl_get_long(&retval)) {
 			rval = 1;
 		}
 	}
@@ -807,6 +807,7 @@
 			}
 		} else {
 			zend_throw_error(NULL, "The CURLOPT_SSH_HOSTKEYFUNCTION callback must return either CURLKHMATCH_OK or CURLKHMATCH_MISMATCH");
+			zval_ptr_dtor(&retval);
 		}
 	}
 
@@ -901,7 +902,7 @@
 			if (!Z_ISUNDEF(retval)) {
 				// TODO: Check for valid int type for return value
 				_php_curl_verify_handlers(ch, /* reporterror */ true);
-				length = zval_get_long(&retval);
+				length = php_curl_get_long(&retval);
 			}
 			zval_ptr_dtor(&argv[0]);
 			zval_ptr_dtor(&argv[1]);
@@ -1322,6 +1323,17 @@
 	(*source->clone)++;
 }
 
+zend_long php_curl_get_long(zval *zv)
+{
+	if (EXPECTED(Z_TYPE_P(zv) == IS_LONG)) {
+		return Z_LVAL_P(zv);
+	} else {
+		zend_long ret = zval_get_long(zv);
+		zval_ptr_dtor(zv);
+		return ret;
+	}
+}
+
 static size_t read_cb(char *buffer, size_t size, size_t nitems, void *arg) /* {{{ */
 {
 	struct mime_data_cb_arg *cb_arg = (struct mime_data_cb_arg *) arg;
@@ -1378,7 +1390,6 @@
 	part = curl_mime_addpart(mime);
 	if (part == NULL) {
 		zend_tmp_string_release(tmp_postval);
-		zend_string_release_ex(string_key, 0);
 		return CURLE_OUT_OF_MEMORY;
 	}
 	if ((form_error = curl_mime_name(part, ZSTR_VAL(string_key))) != CURLE_OK
diff -Nru php8.4-8.4.10/ext/curl/multi.c php8.4-8.4.11/ext/curl/multi.c
--- php8.4-8.4.10/ext/curl/multi.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/curl/multi.c	2025-07-29 17:30:21.000000000 +0200
@@ -410,7 +410,7 @@
 	zval_ptr_dtor_nogc(&headers);
 
 	if (!Z_ISUNDEF(retval)) {
-		if (CURL_PUSH_DENY != zval_get_long(&retval)) {
+		if (CURL_PUSH_DENY != php_curl_get_long(&retval)) {
 		    rval = CURL_PUSH_OK;
 			zend_llist_add_element(&mh->easyh, &pz_ch);
 		} else {
diff -Nru php8.4-8.4.10/ext/curl/tests/refcounted_return_must_not_leak.phpt php8.4-8.4.11/ext/curl/tests/refcounted_return_must_not_leak.phpt
--- php8.4-8.4.10/ext/curl/tests/refcounted_return_must_not_leak.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/curl/tests/refcounted_return_must_not_leak.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,27 @@
+--TEST--
+Returning refcounted value from callback must not leak
+--EXTENSIONS--
+curl
+--FILE--
+<?php
+include 'server.inc';
+$host = curl_cli_server_start();
+
+$url = "{$host}/get.inc";
+$ch = curl_init($url);
+
+function return_non_interned_string() {
+    return str_repeat('x', random_int(5, 5));
+}
+
+curl_setopt($ch, CURLOPT_NOPROGRESS, 0);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+curl_setopt($ch, CURLOPT_PROGRESSFUNCTION, 'return_non_interned_string');
+curl_setopt($ch, CURLOPT_XFERINFOFUNCTION, 'return_non_interned_string');
+curl_setopt($ch, CURLOPT_WRITEFUNCTION, 'return_non_interned_string');
+curl_setopt($ch, CURLOPT_HEADERFUNCTION, 'return_non_interned_string');
+echo curl_exec($ch), PHP_EOL;
+echo "ok";
+?>
+--EXPECT--
+ok
diff -Nru php8.4-8.4.10/ext/dom/tests/modern/xml/gh18979.phpt php8.4-8.4.11/ext/dom/tests/modern/xml/gh18979.phpt
--- php8.4-8.4.10/ext/dom/tests/modern/xml/gh18979.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/dom/tests/modern/xml/gh18979.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,13 @@
+--TEST--
+GH-18979 (DOM\XMLDocument::createComment() triggers undefined behavior with null byte)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$dom = Dom\XMLDocument::createEmpty();
+$container = $dom->createElement("container");
+$container->append($dom->createComment("\0"));
+var_dump($container->innerHTML);
+?>
+--EXPECT--
+string(7) "<!---->"
diff -Nru php8.4-8.4.10/ext/dom/xml_serializer.c php8.4-8.4.11/ext/dom/xml_serializer.c
--- php8.4-8.4.10/ext/dom/xml_serializer.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/dom/xml_serializer.c	2025-07-29 17:30:21.000000000 +0200
@@ -640,7 +640,11 @@
 		const xmlChar *ptr = comment->content;
 		if (ptr != NULL) {
 			TRY(dom_xml_check_char_production(ptr));
-			if (strstr((const char *) ptr, "--") != NULL || ptr[strlen((const char *) ptr) - 1] == '-') {
+			if (strstr((const char *) ptr, "--") != NULL) {
+				return -1;
+			}
+			size_t len = strlen((const char *) ptr);
+			if (len > 0 && ptr[len - 1] == '-') {
 				return -1;
 			}
 		}
diff -Nru php8.4-8.4.10/ext/gd/libgd/gd_interpolation.c php8.4-8.4.11/ext/gd/libgd/gd_interpolation.c
--- php8.4-8.4.10/ext/gd/libgd/gd_interpolation.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/gd/libgd/gd_interpolation.c	2025-07-29 17:30:21.000000000 +0200
@@ -62,11 +62,6 @@
 #include "gdhelpers.h"
 #include "gd_intern.h"
 
-#ifdef _MSC_VER
-# pragma optimize("t", on)
-# include <emmintrin.h>
-#endif
-
 #ifndef MIN
 #define MIN(a,b) ((a)<(b)?(a):(b))
 #endif
diff -Nru php8.4-8.4.10/ext/iconv/tests/translit-failure.phpt php8.4-8.4.11/ext/iconv/tests/translit-failure.phpt
--- php8.4-8.4.10/ext/iconv/tests/translit-failure.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/iconv/tests/translit-failure.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -4,7 +4,7 @@
 iconv
 --SKIPIF--
 <?php
-( ICONV_IMPL != "libiconv" ) and die("skip ICONV_IMPL != \"libiconv\"");
+( ICONV_IMPL != "libiconv" && ICONV_IMPL != "\"libiconv\"" ) and die("skip ICONV_IMPL != \"libiconv\"");
 ?>
 --INI--
 error_reporting=2039
diff -Nru php8.4-8.4.10/ext/iconv/tests/translit-utf8.phpt php8.4-8.4.11/ext/iconv/tests/translit-utf8.phpt
--- php8.4-8.4.10/ext/iconv/tests/translit-utf8.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/iconv/tests/translit-utf8.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -4,7 +4,7 @@
 iconv
 --SKIPIF--
 <?php
-( ICONV_IMPL != "libiconv" ) and die("skip ICONV_IMPL != \"libiconv\"");
+( ICONV_IMPL != "libiconv" && ICONV_IMPL != "\"libiconv\"" ) and die("skip ICONV_IMPL != \"libiconv\"");
 ?>
 --INI--
 error_reporting=2047
diff -Nru php8.4-8.4.10/ext/ldap/ldap.c php8.4-8.4.11/ext/ldap/ldap.c
--- php8.4-8.4.10/ext/ldap/ldap.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/ldap/ldap.c	2025-07-29 17:30:21.000000000 +0200
@@ -4051,7 +4051,12 @@
 		}
 	}
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "OS|S!a!zz", &link, ldap_link_ce, &reqoid, &reqdata, &serverctrls, &retdata, &retoid) != SUCCESS) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "OP|S!a!zz", &link, ldap_link_ce, &reqoid, &reqdata, &serverctrls, &retdata, &retoid) != SUCCESS) {
+		RETURN_THROWS();
+	}
+
+	if (ZSTR_LEN(reqoid) == 0) {
+		zend_argument_must_not_be_empty_error(2);
 		RETURN_THROWS();
 	}
 
diff -Nru php8.4-8.4.10/ext/ldap/tests/gh18902.phpt php8.4-8.4.11/ext/ldap/tests/gh18902.phpt
--- php8.4-8.4.10/ext/ldap/tests/gh18902.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/ldap/tests/gh18902.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,30 @@
+--TEST--
+GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys)
+--EXTENSIONS--
+ldap
+--FILE--
+<?php
+$conn = ldap_connect();
+
+try {
+	ldap_exop($conn,"\0");
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+
+try {
+	ldap_exop_sync($conn,"");
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+
+try {
+	ldap_exop_sync($conn,"test\0");
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+?>
+--EXPECTF--
+ldap_exop(): Argument #2 ($request_oid) must not contain any null bytes
+ldap_exop_sync(): Argument #2 ($request_oid) must not be empty
+ldap_exop_sync(): Argument #2 ($request_oid) must not contain any null bytes
diff -Nru php8.4-8.4.10/ext/mbstring/php_mbregex.c php8.4-8.4.11/ext/mbstring/php_mbregex.c
--- php8.4-8.4.10/ext/mbstring/php_mbregex.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/mbstring/php_mbregex.c	2025-07-29 17:30:21.000000000 +0200
@@ -1184,7 +1184,7 @@
 	size_t string_len;
 
 	int err;
-	zend_long count = -1;
+	zend_ulong count = -1; /* unsigned, it's a limit and we want to prevent signed overflow */
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &arg_pattern, &arg_pattern_len, &string, &string_len, &count) == FAILURE) {
 		RETURN_THROWS();
diff -Nru php8.4-8.4.10/ext/mbstring/tests/gh18901.phpt php8.4-8.4.11/ext/mbstring/tests/gh18901.phpt
--- php8.4-8.4.10/ext/mbstring/tests/gh18901.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/mbstring/tests/gh18901.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,54 @@
+--TEST--
+GH-18901 (integer overflow mb_split)
+--EXTENSIONS--
+mbstring
+--SKIPIF--
+<?php
+if (!function_exists('mb_split')) die('skip mb_split() not available');
+?>
+--FILE--
+<?php
+$vals = [PHP_INT_MIN, PHP_INT_MAX, -1, 0, 1];
+foreach ($vals as $val) {
+    var_dump(mb_split('\d', '123', $val));
+}
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  string(0) ""
+  [1]=>
+  string(0) ""
+  [2]=>
+  string(0) ""
+  [3]=>
+  string(0) ""
+}
+array(4) {
+  [0]=>
+  string(0) ""
+  [1]=>
+  string(0) ""
+  [2]=>
+  string(0) ""
+  [3]=>
+  string(0) ""
+}
+array(4) {
+  [0]=>
+  string(0) ""
+  [1]=>
+  string(0) ""
+  [2]=>
+  string(0) ""
+  [3]=>
+  string(0) ""
+}
+array(1) {
+  [0]=>
+  string(3) "123"
+}
+array(1) {
+  [0]=>
+  string(3) "123"
+}
diff -Nru php8.4-8.4.10/ext/opcache/jit/zend_jit.c php8.4-8.4.11/ext/opcache/jit/zend_jit.c
--- php8.4-8.4.10/ext/opcache/jit/zend_jit.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/opcache/jit/zend_jit.c	2025-07-29 17:30:21.000000000 +0200
@@ -3216,6 +3216,17 @@
 	return FAILURE;
 }
 
+static void zend_jit_link_func_info(zend_op_array *op_array)
+{
+	if (!ZEND_FUNC_INFO(op_array)) {
+		void *jit_extension = zend_shared_alloc_get_xlat_entry(op_array->opcodes);
+
+		if (jit_extension) {
+			ZEND_SET_FUNC_INFO(op_array, jit_extension);
+		}
+	}
+}
+
 int zend_jit_script(zend_script *script)
 {
 	void *checkpoint;
@@ -3302,17 +3313,33 @@
 	 || JIT_G(trigger) == ZEND_JIT_ON_HOT_TRACE) {
 		zend_class_entry *ce;
 		zend_op_array *op_array;
+		zval *zv;
+		zend_property_info *prop;
+
+		ZEND_HASH_MAP_FOREACH_VAL(&script->class_table, zv) {
+			if (Z_TYPE_P(zv) == IS_ALIAS_PTR) {
+				continue;
+			}
+
+			ce = Z_PTR_P(zv);
+			ZEND_ASSERT(ce->type == ZEND_USER_CLASS);
 
-		ZEND_HASH_MAP_FOREACH_PTR(&script->class_table, ce) {
 			ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, op_array) {
-				if (!ZEND_FUNC_INFO(op_array)) {
-					void *jit_extension = zend_shared_alloc_get_xlat_entry(op_array->opcodes);
+				zend_jit_link_func_info(op_array);
+			} ZEND_HASH_FOREACH_END();
 
-					if (jit_extension) {
-						ZEND_SET_FUNC_INFO(op_array, jit_extension);
+			if (ce->num_hooked_props > 0) {
+				ZEND_HASH_MAP_FOREACH_PTR(&ce->properties_info, prop) {
+					if (prop->hooks) {
+						for (uint32_t i = 0; i < ZEND_PROPERTY_HOOK_COUNT; i++) {
+							if (prop->hooks[i]) {
+								op_array = &prop->hooks[i]->op_array;
+								zend_jit_link_func_info(op_array);
+							}
+						}
 					}
-				}
-			} ZEND_HASH_FOREACH_END();
+				} ZEND_HASH_FOREACH_END();
+			}
 		} ZEND_HASH_FOREACH_END();
 	}
 
diff -Nru php8.4-8.4.10/ext/opcache/jit/zend_jit_ir.c php8.4-8.4.11/ext/opcache/jit/zend_jit_ir.c
--- php8.4-8.4.10/ext/opcache/jit/zend_jit_ir.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/opcache/jit/zend_jit_ir.c	2025-07-29 17:30:21.000000000 +0200
@@ -5981,6 +5981,7 @@
 			ir_IF_FALSE_cold(if_def);
 
 			// zend_error_unchecked(E_WARNING, "Undefined variable $%S", CV_DEF_OF(EX_VAR_TO_NUM(opline->op1.var)));
+			jit_SET_EX_OPLINE(jit, opline);
 			ir_CALL_1(IR_VOID, ir_CONST_FC_FUNC(zend_jit_undefined_op_helper), ir_CONST_U32(opline->op1.var));
 
 			ref2 = jit_EG(uninitialized_zval);
@@ -5997,6 +5998,7 @@
 			ir_IF_FALSE_cold(if_def);
 
 			// zend_error_unchecked(E_WARNING, "Undefined variable $%S", CV_DEF_OF(EX_VAR_TO_NUM(opline->op2.var)));
+			jit_SET_EX_OPLINE(jit, opline);
 			ir_CALL_1(IR_VOID, ir_CONST_FC_FUNC(zend_jit_undefined_op_helper), ir_CONST_U32(opline->op2.var));
 
 			ref2 = jit_EG(uninitialized_zval);
diff -Nru php8.4-8.4.10/ext/opcache/tests/gh18639.phpt php8.4-8.4.11/ext/opcache/tests/gh18639.phpt
--- php8.4-8.4.10/ext/opcache/tests/gh18639.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/opcache/tests/gh18639.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,20 @@
+--TEST--
+GH-18639 (Internal class aliases can break preloading + JIT)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=1255
+opcache.jit_buffer_size=16M
+opcache.preload={PWD}/preload_gh18567.inc
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+echo "ok\n";
+?>
+--EXPECT--
+ok
diff -Nru php8.4-8.4.10/ext/opcache/tests/jit/gh14082.phpt php8.4-8.4.11/ext/opcache/tests/jit/gh14082.phpt
--- php8.4-8.4.10/ext/opcache/tests/jit/gh14082.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/opcache/tests/jit/gh14082.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,23 @@
+--TEST--
+GH-14082 (Segmentation fault on unknown address 0x600000000018 in ext/opcache/jit/zend_jit.c)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=1235
+opcache.jit_buffer_size=16M
+opcache.preload={PWD}/preload_gh14082.inc
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+Foo::test();
+echo "ok\n";
+?>
+--EXPECT--
+int(1)
+int(1)
+ok
diff -Nru php8.4-8.4.10/ext/opcache/tests/jit/gh18898_1.phpt php8.4-8.4.11/ext/opcache/tests/jit/gh18898_1.phpt
--- php8.4-8.4.10/ext/opcache/tests/jit/gh18898_1.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/opcache/tests/jit/gh18898_1.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,23 @@
+--TEST--
+GH-18898 (SEGV zend_jit_op_array_hot with property hooks and preloading) - jit 1235
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=1235
+opcache.jit_buffer_size=16M
+opcache.preload={PWD}/../gh18534_preload.inc
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+$test = new DummyModel;
+var_dump($test->dummyProperty2);
+echo "ok";
+?>
+--EXPECT--
+NULL
+ok
diff -Nru php8.4-8.4.10/ext/opcache/tests/jit/gh18898_2.phpt php8.4-8.4.11/ext/opcache/tests/jit/gh18898_2.phpt
--- php8.4-8.4.10/ext/opcache/tests/jit/gh18898_2.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/opcache/tests/jit/gh18898_2.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,23 @@
+--TEST--
+GH-18898 (SEGV zend_jit_op_array_hot with property hooks and preloading) - jit 1233
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=1233
+opcache.jit_buffer_size=16M
+opcache.preload={PWD}/../gh18534_preload.inc
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+$test = new DummyModel;
+var_dump($test->dummyProperty2);
+echo "ok";
+?>
+--EXPECT--
+NULL
+ok
diff -Nru php8.4-8.4.10/ext/opcache/tests/jit/gh18899.phpt php8.4-8.4.11/ext/opcache/tests/jit/gh18899.phpt
--- php8.4-8.4.10/ext/opcache/tests/jit/gh18899.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/opcache/tests/jit/gh18899.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,21 @@
+--TEST--
+GH-18899 (JIT function crash when emitting undefined variable warning and opline is not set yet)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=1205
+opcache.jit_buffer_size=8M
+--FILE--
+<?php
+function ptr2str()
+{
+    for ($i=0; $i<8; $i++) {
+        $ptr >>= 8;
+    }
+}
+str_repeat("A",232).ptr2str();
+?>
+--EXPECTF--
+Warning: Undefined variable $ptr in %s on line %d
diff -Nru php8.4-8.4.10/ext/opcache/tests/jit/preload_gh14082.inc php8.4-8.4.11/ext/opcache/tests/jit/preload_gh14082.inc
--- php8.4-8.4.10/ext/opcache/tests/jit/preload_gh14082.inc	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/opcache/tests/jit/preload_gh14082.inc	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,9 @@
+<?php
+class Foo {
+    public static function test() {
+        static $i = 0;
+        var_dump(++$i);
+    }
+}
+
+Foo::test();
diff -Nru php8.4-8.4.10/ext/opcache/ZendAccelerator.c php8.4-8.4.11/ext/opcache/ZendAccelerator.c
--- php8.4-8.4.10/ext/opcache/ZendAccelerator.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/opcache/ZendAccelerator.c	2025-07-29 17:30:21.000000000 +0200
@@ -56,6 +56,8 @@
 
 #ifdef HAVE_JIT
 # include "jit/zend_jit.h"
+# include "Optimizer/zend_func_info.h"
+# include "Optimizer/zend_call_graph.h"
 #endif
 
 #ifndef ZEND_WIN32
@@ -4471,6 +4473,39 @@
 	}
 }
 
+#if HAVE_JIT
+static void zend_accel_clear_call_graph_ptrs(zend_op_array *op_array)
+{
+	ZEND_ASSERT(ZEND_USER_CODE(op_array->type));
+	zend_func_info *info = ZEND_FUNC_INFO(op_array);
+	if (info) {
+		info->caller_info = NULL;
+		info->callee_info = NULL;
+	}
+}
+
+static void accel_reset_arena_info(zend_persistent_script *script)
+{
+	zend_op_array *op_array;
+	zend_class_entry *ce;
+
+	zend_accel_clear_call_graph_ptrs(&script->script.main_op_array);
+	ZEND_HASH_MAP_FOREACH_PTR(&script->script.function_table, op_array) {
+		zend_accel_clear_call_graph_ptrs(op_array);
+	} ZEND_HASH_FOREACH_END();
+	ZEND_HASH_MAP_FOREACH_PTR(&script->script.class_table, ce) {
+		ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, op_array) {
+			if (op_array->scope == ce
+			 && op_array->type == ZEND_USER_FUNCTION
+			 && !(op_array->fn_flags & ZEND_ACC_ABSTRACT)
+			 && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
+				zend_accel_clear_call_graph_ptrs(op_array);
+			}
+		} ZEND_HASH_FOREACH_END();
+	} ZEND_HASH_FOREACH_END();
+}
+#endif
+
 static zend_result accel_preload(const char *config, bool in_child)
 {
 	zend_file_handle file_handle;
@@ -4683,6 +4718,18 @@
 		} ZEND_HASH_FOREACH_END();
 		ZCSG(saved_scripts)[i] = NULL;
 
+#if HAVE_JIT
+		/* During persisting, the JIT may trigger and fill in the call graph.
+		 * The call graph info is allocated on the arena which will be gone after preloading.
+		 * To prevent invalid accesses during normal requests, the arena data should be cleared.
+		 * This has to be done after all scripts have been persisted because shared op arrays between
+		 * scripts can change the call graph. */
+		accel_reset_arena_info(ZCSG(preload_script));
+		for (zend_persistent_script **scripts = ZCSG(saved_scripts); *scripts; scripts++) {
+			accel_reset_arena_info(*scripts);
+		}
+#endif
+
 		zend_shared_alloc_save_state();
 		accel_interned_strings_save_state();
 
diff -Nru php8.4-8.4.10/ext/opcache/zend_persist.c php8.4-8.4.11/ext/opcache/zend_persist.c
--- php8.4-8.4.10/ext/opcache/zend_persist.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/opcache/zend_persist.c	2025-07-29 17:30:21.000000000 +0200
@@ -1262,6 +1262,41 @@
 	}
 }
 
+#ifdef HAVE_JIT
+static void zend_accel_persist_jit_op_array(zend_op_array *op_array, zend_class_entry *ce)
+{
+	if (op_array->type == ZEND_USER_FUNCTION) {
+		if (op_array->scope == ce
+		 && !(op_array->fn_flags & ZEND_ACC_ABSTRACT)
+		 && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
+			zend_jit_op_array(op_array, ZCG(current_persistent_script) ? &ZCG(current_persistent_script)->script : NULL);
+			for (uint32_t i = 0; i < op_array->num_dynamic_func_defs; i++) {
+				zend_jit_op_array(op_array->dynamic_func_defs[i], ZCG(current_persistent_script) ? &ZCG(current_persistent_script)->script : NULL);
+			}
+		}
+	}
+}
+
+static void zend_accel_persist_link_func_info(zend_op_array *op_array, zend_class_entry *ce)
+{
+	if (op_array->type == ZEND_USER_FUNCTION
+	 && !(op_array->fn_flags & ZEND_ACC_ABSTRACT)) {
+		if ((op_array->scope != ce
+		 || (op_array->fn_flags & ZEND_ACC_TRAIT_CLONE))
+		  && (JIT_G(trigger) == ZEND_JIT_ON_FIRST_EXEC
+		  || JIT_G(trigger) == ZEND_JIT_ON_PROF_REQUEST
+		  || JIT_G(trigger) == ZEND_JIT_ON_HOT_COUNTERS
+		  || JIT_G(trigger) == ZEND_JIT_ON_HOT_TRACE)) {
+			void *jit_extension = zend_shared_alloc_get_xlat_entry(op_array->opcodes);
+
+			if (jit_extension) {
+				ZEND_SET_FUNC_INFO(op_array, jit_extension);
+			}
+		}
+	}
+}
+#endif
+
 static void zend_accel_persist_class_table(HashTable *class_table)
 {
 	Bucket *p;
@@ -1288,44 +1323,48 @@
 	if (JIT_G(on) && JIT_G(opt_level) <= ZEND_JIT_LEVEL_OPT_FUNCS &&
 	    !ZCG(current_persistent_script)->corrupted) {
 	    zend_op_array *op_array;
+		zend_property_info *prop;
 
 	    ZEND_HASH_MAP_FOREACH_BUCKET(class_table, p) {
 			if (EXPECTED(Z_TYPE(p->val) != IS_ALIAS_PTR)) {
 				ce = Z_PTR(p->val);
 				ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, op_array) {
-					if (op_array->type == ZEND_USER_FUNCTION) {
-						if (op_array->scope == ce
-						 && !(op_array->fn_flags & ZEND_ACC_ABSTRACT)
-						 && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
-							zend_jit_op_array(op_array, ZCG(current_persistent_script) ? &ZCG(current_persistent_script)->script : NULL);
-							for (uint32_t i = 0; i < op_array->num_dynamic_func_defs; i++) {
-								zend_jit_op_array(op_array->dynamic_func_defs[i], ZCG(current_persistent_script) ? &ZCG(current_persistent_script)->script : NULL);
+					zend_accel_persist_jit_op_array(op_array, ce);
+				} ZEND_HASH_FOREACH_END();
+
+				if (ce->num_hooked_props > 0) {
+					ZEND_HASH_MAP_FOREACH_PTR(&ce->properties_info, prop) {
+						if (prop->hooks) {
+							for (uint32_t i = 0; i < ZEND_PROPERTY_HOOK_COUNT; i++) {
+								if (prop->hooks[i]) {
+									op_array = &prop->hooks[i]->op_array;
+									zend_accel_persist_jit_op_array(op_array, ce);
+								}
 							}
 						}
-					}
-				} ZEND_HASH_FOREACH_END();
+					} ZEND_HASH_FOREACH_END();
+				}
 			}
 		} ZEND_HASH_FOREACH_END();
 	    ZEND_HASH_MAP_FOREACH_BUCKET(class_table, p) {
 			if (EXPECTED(Z_TYPE(p->val) != IS_ALIAS_PTR)) {
 				ce = Z_PTR(p->val);
 				ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, op_array) {
-					if (op_array->type == ZEND_USER_FUNCTION
-					 && !(op_array->fn_flags & ZEND_ACC_ABSTRACT)) {
-						if ((op_array->scope != ce
-						 || (op_array->fn_flags & ZEND_ACC_TRAIT_CLONE))
-						  && (JIT_G(trigger) == ZEND_JIT_ON_FIRST_EXEC
-						   || JIT_G(trigger) == ZEND_JIT_ON_PROF_REQUEST
-						   || JIT_G(trigger) == ZEND_JIT_ON_HOT_COUNTERS
-						   || JIT_G(trigger) == ZEND_JIT_ON_HOT_TRACE)) {
-							void *jit_extension = zend_shared_alloc_get_xlat_entry(op_array->opcodes);
+					zend_accel_persist_link_func_info(op_array, ce);
+				} ZEND_HASH_FOREACH_END();
 
-							if (jit_extension) {
-								ZEND_SET_FUNC_INFO(op_array, jit_extension);
+				if (ce->num_hooked_props > 0) {
+					ZEND_HASH_MAP_FOREACH_PTR(&ce->properties_info, prop) {
+						if (prop->hooks) {
+							for (uint32_t i = 0; i < ZEND_PROPERTY_HOOK_COUNT; i++) {
+								if (prop->hooks[i]) {
+									op_array = &prop->hooks[i]->op_array;
+									zend_accel_persist_link_func_info(op_array, ce);
+								}
 							}
 						}
-					}
-				} ZEND_HASH_FOREACH_END();
+					} ZEND_HASH_FOREACH_END();
+				}
 			}
 		} ZEND_HASH_FOREACH_END();
 	}
diff -Nru php8.4-8.4.10/ext/openssl/tests/bug80770.phpt php8.4-8.4.11/ext/openssl/tests/bug80770.phpt
--- php8.4-8.4.10/ext/openssl/tests/bug80770.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/openssl/tests/bug80770.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,83 @@
+--TEST--
+Bug #80770: SNI_server_certs does not inherit peer verification options
+--EXTENSIONS--
+openssl
+--SKIPIF--
+<?php
+if (!function_exists("proc_open")) die("skip no proc_open");
+if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
+?>
+--FILE--
+<?php
+$clientCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_client.pem.tmp';
+$caCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_ca.pem.tmp';
+
+$serverCode = <<<'CODE'
+    $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+    $ctx = stream_context_create(['ssl' => [
+        'SNI_server_certs' => [
+            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
+            "uk.php.net" => __DIR__ . "/sni_server_uk.pem",
+            "us.php.net" => __DIR__ . "/sni_server_us.pem"
+        ],
+        'verify_peer' => true,
+        'cafile' => '%s',
+        'capture_peer_cert' => true,
+        'verify_peer_name' => false,
+        'security_level' => 0,
+    ]]);
+    $server = stream_socket_server('tcp://127.0.0.1:0', $errno, $errstr, $flags, $ctx);
+    phpt_notify_server_start($server);
+
+    $client = stream_socket_accept($server, 30);
+    if ($client) {
+        $success = stream_socket_enable_crypto($client, true, STREAM_CRYPTO_METHOD_TLS_SERVER);
+        if ($success) {
+            $options = stream_context_get_options($client);
+            $hasCert = isset($options['ssl']['peer_certificate']);
+            phpt_notify(message: $hasCert ? "CLIENT_CERT_CAPTURED" : "NO_CLIENT_CERT");
+        } else {
+            phpt_notify(message: "TLS_HANDSHAKE_FAILED");
+        }
+    } else {
+        phpt_notify(message: "ACCEPT_FAILED");
+    }
+CODE;
+$serverCode = sprintf($serverCode, $caCertFile);
+
+$clientCode = <<<'CODE'
+    $flags = STREAM_CLIENT_CONNECT;
+    $ctx = stream_context_create(['ssl' => [
+        'verify_peer' => false,
+        'verify_peer_name' => false,
+        'local_cert' => '%s',
+        'peer_name' => 'cs.php.net',
+        'security_level' => 0,
+    ]]);
+    $client = stream_socket_client("tcp://{{ ADDR }}", $errno, $errstr, 30, $flags, $ctx);
+    if ($client) {
+        stream_socket_enable_crypto($client, true, STREAM_CRYPTO_METHOD_TLS_CLIENT);
+    }
+
+    $result = phpt_wait();
+    echo trim($result);
+CODE;
+$clientCode = sprintf($clientCode, $clientCertFile);
+
+include 'CertificateGenerator.inc';
+
+// Generate CA and client certificate signed by that CA
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($caCertFile);
+$certificateGenerator->saveNewCertAsFileWithKey('Bug80770 Test Client', $clientCertFile);
+
+include 'ServerClientTestCase.inc';
+ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_client.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_ca.pem.tmp');
+?>
+--EXPECTF--
+CLIENT_CERT_CAPTURED
diff -Nru php8.4-8.4.10/ext/openssl/xp_ssl.c php8.4-8.4.11/ext/openssl/xp_ssl.c
--- php8.4-8.4.10/ext/openssl/xp_ssl.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/openssl/xp_ssl.c	2025-07-29 17:30:21.000000000 +0200
@@ -1439,7 +1439,8 @@
 }
 /* }}} */
 
-static zend_result php_openssl_enable_server_sni(php_stream *stream, php_openssl_netstream_data_t *sslsock)  /* {{{ */
+static zend_result php_openssl_enable_server_sni(
+		php_stream *stream, php_openssl_netstream_data_t *sslsock, bool verify_peer)
 {
 	zval *val;
 	zval *current;
@@ -1560,6 +1561,12 @@
 			return FAILURE;
 		}
 
+		if (!verify_peer) {
+			php_openssl_disable_peer_verification(ctx, stream);
+		} else if (FAILURE == php_openssl_enable_peer_verification(ctx, stream)) {
+			return FAILURE;
+		}
+
 		sslsock->sni_certs[i].name = pestrdup(ZSTR_VAL(key), php_stream_is_persistent(stream));
 		sslsock->sni_certs[i].ctx = ctx;
 		++i;
@@ -1570,7 +1577,6 @@
 
 	return SUCCESS;
 }
-/* }}} */
 
 static void php_openssl_enable_client_sni(php_stream *stream, php_openssl_netstream_data_t *sslsock) /* {{{ */
 {
@@ -1662,6 +1668,7 @@
 	char *cipherlist = NULL;
 	char *alpn_protocols = NULL;
 	zval *val;
+	bool verify_peer = false;
 
 	if (sslsock->ssl_handle) {
 		if (sslsock->s.is_blocked) {
@@ -1713,8 +1720,11 @@
 
 	if (GET_VER_OPT("verify_peer") && !zend_is_true(val)) {
 		php_openssl_disable_peer_verification(sslsock->ctx, stream);
-	} else if (FAILURE == php_openssl_enable_peer_verification(sslsock->ctx, stream)) {
-		return FAILURE;
+	} else {
+		verify_peer = true;
+		if (FAILURE == php_openssl_enable_peer_verification(sslsock->ctx, stream)) {
+			return FAILURE;
+		}
 	}
 
 	/* callback for the passphrase (for localcert) */
@@ -1815,7 +1825,7 @@
 
 #ifdef HAVE_TLS_SNI
 	/* Enable server-side SNI */
-	if (!sslsock->is_client && php_openssl_enable_server_sni(stream, sslsock) == FAILURE) {
+	if (!sslsock->is_client && php_openssl_enable_server_sni(stream, sslsock, verify_peer) == FAILURE) {
 		return FAILURE;
 	}
 #endif
diff -Nru php8.4-8.4.10/ext/pcntl/pcntl.c php8.4-8.4.11/ext/pcntl/pcntl.c
--- php8.4-8.4.10/ext/pcntl/pcntl.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/pcntl/pcntl.c	2025-07-29 17:30:21.000000000 +0200
@@ -1513,6 +1513,8 @@
 		default:
 			php_error_docref(NULL, E_WARNING, "Error %d", errno);
 		}
+	} else if (pid == 0) {
+		zend_max_execution_timer_init();
 	}
 
 	RETURN_LONG((zend_long) pid);
@@ -1556,6 +1558,8 @@
 		default:
 			php_error_docref(NULL, E_WARNING, "Error %d", errno);
 		}
+	} else if (pid == 0) {
+		zend_max_execution_timer_init();
 	}
 
 	RETURN_LONG((zend_long) pid);
diff -Nru php8.4-8.4.10/ext/phar/phar.c php8.4-8.4.11/ext/phar/phar.c
--- php8.4-8.4.10/ext/phar/phar.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/phar/phar.c	2025-07-29 17:30:21.000000000 +0200
@@ -2700,7 +2700,7 @@
 			/* remove this from the new phar */
 			continue;
 		}
-		if (!entry->is_modified && entry->fp_refcount) {
+		if (entry->fp_refcount) {
 			/* open file pointers refer to this fp, do not free the stream */
 			switch (entry->fp_type) {
 				case PHAR_FP:
diff -Nru php8.4-8.4.10/ext/phar/phar_object.c php8.4-8.4.11/ext/phar/phar_object.c
--- php8.4-8.4.10/ext/phar/phar_object.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/phar/phar_object.c	2025-07-29 17:30:21.000000000 +0200
@@ -1934,7 +1934,8 @@
 {
 	char *error;
 	zend_off_t offset;
-	phar_entry_info *link;
+
+	ZEND_ASSERT(!entry->link);
 
 	if (FAILURE == phar_open_entry_fp(entry, &error, 1)) {
 		if (error) {
@@ -1949,26 +1950,14 @@
 	}
 
 	/* copy old contents in entirety */
-	phar_seek_efp(entry, 0, SEEK_SET, 0, 1);
+	phar_seek_efp(entry, 0, SEEK_SET, 0, 0);
 	offset = php_stream_tell(fp);
-	link = phar_get_link_source(entry);
-
-	if (!link) {
-		link = entry;
-	}
-
-	if (SUCCESS != php_stream_copy_to_stream_ex(phar_get_efp(link, 0), fp, link->uncompressed_filesize, NULL)) {
+	if (SUCCESS != php_stream_copy_to_stream_ex(phar_get_efp(entry, 0), fp, entry->uncompressed_filesize, NULL)) {
 		zend_throw_exception_ex(spl_ce_UnexpectedValueException, 0,
 			"Cannot convert phar archive \"%s\", unable to copy entry \"%s\" contents", entry->phar->fname, entry->filename);
 		return FAILURE;
 	}
 
-	if (entry->fp_type == PHAR_MOD) {
-		/* save for potential restore on error */
-		entry->cfp = entry->fp;
-		entry->fp = NULL;
-	}
-
 	/* set new location of file contents */
 	entry->fp_type = PHAR_FP;
 	entry->offset = offset;
@@ -2307,6 +2296,10 @@
 			return NULL;
 		}
 no_copy:
+		/* Reset file pointers, they have to be reset here such that if a copy happens the original
+		 * source fp can be accessed. */
+		newentry.fp = NULL;
+		newentry.cfp = NULL;
 		newentry.filename = estrndup(newentry.filename, newentry.filename_len);
 
 		phar_metadata_tracker_clone(&newentry.metadata_tracker);
diff -Nru php8.4-8.4.10/ext/phar/stream.c php8.4-8.4.11/ext/phar/stream.c
--- php8.4-8.4.10/ext/phar/stream.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/phar/stream.c	2025-07-29 17:30:21.000000000 +0200
@@ -449,12 +449,12 @@
 {
 	phar_entry_data *data = (phar_entry_data *) stream->abstract;
 
-	php_stream_seek(data->fp, data->position, SEEK_SET);
+	php_stream_seek(data->fp, data->position + data->zero, SEEK_SET);
 	if (count != php_stream_write(data->fp, buf, count)) {
 		php_stream_wrapper_log_error(stream->wrapper, stream->flags, "phar error: Could not write %d characters to \"%s\" in phar \"%s\"", (int) count, data->internal_file->filename, data->phar->fname);
 		return -1;
 	}
-	data->position = php_stream_tell(data->fp);
+	data->position = php_stream_tell(data->fp) - data->zero;
 	if (data->position > (zend_off_t)data->internal_file->uncompressed_filesize) {
 		data->internal_file->uncompressed_filesize = data->position;
 	}
diff -Nru php8.4-8.4.10/ext/phar/tar.c php8.4-8.4.11/ext/phar/tar.c
--- php8.4-8.4.10/ext/phar/tar.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/phar/tar.c	2025-07-29 17:30:21.000000000 +0200
@@ -834,7 +834,7 @@
 		php_stream_write(fp->new, padding, ((entry->uncompressed_filesize +511)&~511) - entry->uncompressed_filesize);
 	}
 
-	if (!entry->is_modified && entry->fp_refcount) {
+	if (entry->fp_refcount) {
 		/* open file pointers refer to this fp, do not free the stream */
 		switch (entry->fp_type) {
 			case PHAR_FP:
diff -Nru php8.4-8.4.10/ext/phar/tests/gh18953.phpt php8.4-8.4.11/ext/phar/tests/gh18953.phpt
--- php8.4-8.4.10/ext/phar/tests/gh18953.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/phar/tests/gh18953.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,41 @@
+--TEST--
+GH-18953 (Phar: Stream double free)
+--EXTENSIONS--
+phar
+zlib
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+
+$phar = new Phar(__DIR__ . "/gh18953.phar");
+$phar->addFromString("file", str_repeat("123", random_int(1, 1)));
+$phar->addEmptyDir("dir");
+$phar2 = $phar->compress(Phar::GZ);
+
+var_dump($phar["dir"]);
+var_dump($phar2["dir"]);
+var_dump($phar["file"]->openFile()->fread(100));
+var_dump($phar2["file"]->openFile()->fread(100));
+
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . "/gh18953.phar");
+@unlink(__DIR__ . "/gh18953.phar.gz");
+?>
+--EXPECTF--
+object(PharFileInfo)#%d (2) {
+  ["pathName":"SplFileInfo":private]=>
+  string(%d) "%sphar%sdir"
+  ["fileName":"SplFileInfo":private]=>
+  string(3) "dir"
+}
+object(PharFileInfo)#%d (2) {
+  ["pathName":"SplFileInfo":private]=>
+  string(%d) "%sphar.gz%sdir"
+  ["fileName":"SplFileInfo":private]=>
+  string(3) "dir"
+}
+string(3) "123"
+string(3) "123"
diff -Nru php8.4-8.4.10/ext/phar/tests/gh19038.phpt php8.4-8.4.11/ext/phar/tests/gh19038.phpt
--- php8.4-8.4.10/ext/phar/tests/gh19038.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/phar/tests/gh19038.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,25 @@
+--TEST--
+GH-19038 (Phar crash and data corruption with SplFileObject)
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+
+$phar = new Phar(__DIR__ . "/gh19038.phar");
+$phar->addFromString("file", "123");
+$file = $phar["file"]->openFile();
+$file->fseek(3);
+var_dump($file->fwrite("456", 3));
+$file->fseek(0);
+echo $file->fread(100);
+
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . "/gh19038.phar");
+?>
+--EXPECT--
+int(3)
+123456
diff -Nru php8.4-8.4.10/ext/soap/php_http.c php8.4-8.4.11/ext/soap/php_http.c
--- php8.4-8.4.10/ext/soap/php_http.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/soap/php_http.c	2025-07-29 17:30:21.000000000 +0200
@@ -506,9 +506,9 @@
 		     zend_string_equals(orig->host, phpurl->host) &&
 		     orig->port == phpurl->port))) {
 		} else {
+			ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 			php_stream_close(stream);
 			convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
-			convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 			convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 			stream = NULL;
 			use_proxy = 0;
@@ -517,9 +517,9 @@
 
 	/* Check if keep-alive connection is still opened */
 	if (stream != NULL && php_stream_eof(stream)) {
+		ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		php_stream_close(stream);
 		convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
-		convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 		stream = NULL;
 		use_proxy = 0;
@@ -528,9 +528,7 @@
 	if (!stream) {
 		stream = http_connect(this_ptr, phpurl, use_ssl, context, &use_proxy);
 		if (stream) {
-			php_stream_auto_cleanup(stream);
-			ZVAL_RES(Z_CLIENT_HTTPSOCKET_P(this_ptr), stream->res);
-			GC_ADDREF(stream->res);
+			php_stream_to_zval(stream, Z_CLIENT_HTTPSOCKET_P(this_ptr));
 			ZVAL_LONG(Z_CLIENT_USE_PROXY_P(this_ptr), use_proxy);
 		} else {
 			php_url_free(phpurl);
@@ -686,9 +684,9 @@
 
 				if (UNEXPECTED(php_random_bytes_throw(&nonce, sizeof(nonce)) != SUCCESS)) {
 					ZEND_ASSERT(EG(exception));
+					ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 					php_stream_close(stream);
 					convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
-					convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 					convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 					smart_str_free(&soap_headers_z);
 					smart_str_free(&soap_headers);
@@ -904,9 +902,9 @@
 			if (request != buf) {
 				zend_string_release_ex(request, 0);
 			}
+			ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 			php_stream_close(stream);
 			convert_to_null(Z_CLIENT_HTTPURL_P(this_ptr));
-			convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 			convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 			add_soap_fault(this_ptr, "HTTP", "Failed Sending HTTP SOAP request", NULL, NULL);
 			smart_str_free(&soap_headers_z);
@@ -929,8 +927,8 @@
 				if (request != buf) {
 					zend_string_release_ex(request, 0);
 				}
+				ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 				php_stream_close(stream);
-				convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 				convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 				add_soap_fault(this_ptr, "HTTP", "Error Fetching http headers", NULL, NULL);
 				smart_str_free(&soap_headers_z);
@@ -982,11 +980,11 @@
 		if (request != buf) {
 			zend_string_release_ex(request, 0);
 		}
+		ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		php_stream_close(stream);
 		if (http_headers) {
 			zend_string_release_ex(http_headers, 0);
 		}
-		convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 		if (http_msg) {
 			efree(http_msg);
@@ -1117,9 +1115,9 @@
 		if (request != buf) {
 			zend_string_release_ex(request, 0);
 		}
+		ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		php_stream_close(stream);
 		zend_string_release_ex(http_headers, 0);
-		convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 		add_soap_fault(this_ptr, "HTTP", "Error Fetching http body, No Content-Length, connection closed or chunked data", NULL, NULL);
 		if (http_msg) {
@@ -1134,8 +1132,8 @@
 	}
 
 	if (http_close) {
+		ZVAL_NULL(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		php_stream_close(stream);
-		convert_to_null(Z_CLIENT_HTTPSOCKET_P(this_ptr));
 		convert_to_null(Z_CLIENT_USE_PROXY_P(this_ptr));
 		stream = NULL;
 	}
@@ -1146,11 +1144,11 @@
 
 		if ((loc = get_http_header_value(ZSTR_VAL(http_headers), "Location:")) != NULL) {
 			php_url *new_url  = php_url_parse(loc);
+			efree(loc);
 
 			if (new_url != NULL) {
 				zend_string_release_ex(http_headers, 0);
 				zend_string_release_ex(http_body, 0);
-				efree(loc);
 				if (new_url->scheme == NULL && new_url->path != NULL) {
 					new_url->scheme = phpurl->scheme ? zend_string_copy(phpurl->scheme) : NULL;
 					new_url->host = phpurl->host ? zend_string_copy(phpurl->host) : NULL;
diff -Nru php8.4-8.4.10/ext/soap/tests/bugs/gh18990.phpt php8.4-8.4.11/ext/soap/tests/bugs/gh18990.phpt
--- php8.4-8.4.10/ext/soap/tests/bugs/gh18990.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/soap/tests/bugs/gh18990.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,58 @@
+--TEST--
+GH-18990 (SOAP HTTP socket not closing on object destruction)
+--INI--
+soap.wsdl_cache_enabled=0
+--EXTENSIONS--
+soap
+--SKIPIF--
+<?php
+require __DIR__.'/../../../standard/tests/http/server.inc';
+http_server_skipif();
+--FILE--
+<?php
+require __DIR__.'/../../../standard/tests/http/server.inc';
+
+$wsdl = file_get_contents(__DIR__.'/../server030.wsdl');
+
+$soap = <<<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://testuri.org" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:getItemsResponse><getItemsReturn SOAP-ENC:arrayType="ns1:Item[10]" xsi:type="ns1:ItemArray"><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text0</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text1</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text2</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text3</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text4</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text5</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text6</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text7</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text8</text></item><item xsi:type="ns1:Item"><text xsi:type="xsd:string">text9</text></item></getItemsReturn></ns1:getItemsResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>
+EOF;
+
+$responses = [
+    "data://text/plain,HTTP/1.1 200 OK\r\n".
+    "Content-Type: text/xml;charset=utf-8\r\n".
+    "Connection: Keep-Alive\r\n".
+    "Content-Length: ".strlen($wsdl)."\r\n".
+    "\r\n".
+    $wsdl,
+
+    "data://text/plain,HTTP/1.1 200 OK\r\n".
+    "Content-Type: text/xml;charset=utf-8\r\n".
+    "Connection: Keep-Alive\r\n".
+    "Content-Length: ".strlen($soap)."\r\n".
+    "\r\n".
+    $soap,
+];
+
+['pid' => $pid, 'uri' => $uri] = http_server($responses);
+
+$options = [
+    'trace' => false,
+    'location' => $uri,
+];
+
+$cnt = count(get_resources());
+
+$client = new SoapClient($uri, $options);
+
+var_dump(count($client->getItems()));
+
+http_server_kill($pid);
+
+unset($client);
+var_dump(count(get_resources()) - $cnt);
+?>
+--EXPECT--
+int(10)
+int(0)
diff -Nru php8.4-8.4.10/ext/spl/spl_observer.c php8.4-8.4.11/ext/spl/spl_observer.c
--- php8.4-8.4.10/ext/spl/spl_observer.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/spl/spl_observer.c	2025-07-29 17:30:21.000000000 +0200
@@ -39,6 +39,7 @@
 PHPAPI zend_class_entry     *spl_ce_MultipleIterator;
 
 static zend_object_handlers spl_handler_SplObjectStorage;
+static zend_object_handlers spl_handler_MultipleIterator;
 
 /* Bit flags for marking internal functionality overridden by SplObjectStorage subclasses. */
 #define SOS_OVERRIDDEN_READ_DIMENSION  1
@@ -488,6 +489,20 @@
 	spl_object_storage_attach_handle(intern, Z_OBJ_P(offset), inf);
 }
 
+static void spl_multiple_iterator_write_dimension(zend_object *object, zval *offset, zval *inf)
+{
+	spl_SplObjectStorage *intern = spl_object_storage_from_obj(object);
+	if (UNEXPECTED(offset == NULL || Z_TYPE_P(offset) != IS_OBJECT || (intern->flags & SOS_OVERRIDDEN_WRITE_DIMENSION))) {
+		zend_std_write_dimension(object, offset, inf);
+		return;
+	}
+	if (UNEXPECTED(!Z_OBJCE_P(offset)->iterator_funcs_ptr || !Z_OBJCE_P(offset)->iterator_funcs_ptr->zf_valid)) {
+		zend_type_error("Can only attach objects that implement the Iterator interface");
+		return;
+	}
+	spl_object_storage_attach_handle(intern, Z_OBJ_P(offset), inf);
+}
+
 static void spl_object_storage_unset_dimension(zend_object *object, zval *offset)
 {
 	spl_SplObjectStorage *intern = spl_object_storage_from_obj(object);
@@ -1390,9 +1405,13 @@
 	spl_handler_SplObjectStorage.has_dimension   = spl_object_storage_has_dimension;
 	spl_handler_SplObjectStorage.unset_dimension = spl_object_storage_unset_dimension;
 
+	memcpy(&spl_handler_MultipleIterator, &spl_handler_SplObjectStorage, sizeof(zend_object_handlers));
+
+	spl_handler_MultipleIterator.write_dimension = spl_multiple_iterator_write_dimension;
+
 	spl_ce_MultipleIterator = register_class_MultipleIterator(zend_ce_iterator);
 	spl_ce_MultipleIterator->create_object = spl_SplObjectStorage_new;
-	spl_ce_MultipleIterator->default_object_handlers = &spl_handler_SplObjectStorage;
+	spl_ce_MultipleIterator->default_object_handlers = &spl_handler_MultipleIterator;
 
 	return SUCCESS;
 }
diff -Nru php8.4-8.4.10/ext/spl/tests/gh19094.phpt php8.4-8.4.11/ext/spl/tests/gh19094.phpt
--- php8.4-8.4.10/ext/spl/tests/gh19094.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/spl/tests/gh19094.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,56 @@
+--TEST--
+GH-19094 (Attaching class with no Iterator implementation to MultipleIterator causes crash)
+--FILE--
+<?php
+
+class MyIterator implements Iterator {
+    public function valid(): bool {
+        return false;
+    }
+
+    public function current(): mixed {
+        return null;
+    }
+
+    public function key(): string {
+        return "";
+    }
+
+    public function next(): void {
+    }
+
+    public function rewind(): void {
+    }
+}
+
+class MyAggregate implements IteratorAggregate {
+    public function getIterator(): Traversable
+    {
+        throw new Error;
+    }
+}
+
+$cls = new MultipleIterator();
+$canary = new stdClass;
+try {
+    $cls[$canary] = 1;
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $cls[new MyAggregate] = 1;
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+$cls[new MyIterator] = 1;
+try {
+    $cls->key();
+} catch (RuntimeException $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Can only attach objects that implement the Iterator interface
+Can only attach objects that implement the Iterator interface
+Called key() with non valid sub iterator
diff -Nru php8.4-8.4.10/ext/sqlite3/sqlite3.c php8.4-8.4.11/ext/sqlite3/sqlite3.c
--- php8.4-8.4.10/ext/sqlite3/sqlite3.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/sqlite3/sqlite3.c	2025-07-29 17:30:21.000000000 +0200
@@ -1164,6 +1164,7 @@
 					sqlite3_stream->position = sqlite3_stream->position + offset;
 					*newoffs = sqlite3_stream->position;
 					stream->eof = 0;
+					stream->fatal_error = 0;
 					return 0;
 				}
 			} else {
@@ -1175,6 +1176,7 @@
 					sqlite3_stream->position = sqlite3_stream->position + offset;
 					*newoffs = sqlite3_stream->position;
 					stream->eof = 0;
+					stream->fatal_error = 0;
 					return 0;
 				}
 			}
@@ -1187,6 +1189,7 @@
 				sqlite3_stream->position = offset;
 				*newoffs = sqlite3_stream->position;
 				stream->eof = 0;
+				stream->fatal_error = 0;
 				return 0;
 			}
 		case SEEK_END:
@@ -1202,6 +1205,7 @@
 				sqlite3_stream->position = sqlite3_stream->size + offset;
 				*newoffs = sqlite3_stream->position;
 				stream->eof = 0;
+				stream->fatal_error = 0;
 				return 0;
 			}
 		default:
diff -Nru php8.4-8.4.10/ext/standard/basic_functions_arginfo.h php8.4-8.4.11/ext/standard/basic_functions_arginfo.h
--- php8.4-8.4.10/ext/standard/basic_functions_arginfo.h	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/basic_functions_arginfo.h	2025-07-29 17:30:21.000000000 +0200
@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: b15d2f9fa727a78e6fa4d5c60a65d8848f655fe2 */
+ * Stub hash: 5eeeaf1f292c72e4553dabc5a64f27781bf57d86 */
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_set_time_limit, 0, 1, _IS_BOOL, 0)
 	ZEND_ARG_TYPE_INFO(0, seconds, IS_LONG, 0)
diff -Nru php8.4-8.4.10/ext/standard/basic_functions.stub.php php8.4-8.4.11/ext/standard/basic_functions.stub.php
--- php8.4-8.4.10/ext/standard/basic_functions.stub.php	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/basic_functions.stub.php	2025-07-29 17:30:21.000000000 +0200
@@ -1686,13 +1686,11 @@
 
 /**
  * @compile-time-eval
- * @refcount 1
  */
 function array_replace(array $array, array ...$replacements): array {}
 
 /**
  * @compile-time-eval
- * @refcount 1
  */
 function array_replace_recursive(array $array, array ...$replacements): array {}
 
@@ -1765,19 +1763,16 @@
 
 /**
  * @param array|callable $rest
- * @refcount 1
  */
 function array_intersect_ukey(array $array, ...$rest): array {}
 
 /**
  * @compile-time-eval
- * @refcount 1
  */
 function array_intersect(array $array, array ...$arrays): array {}
 
 /**
  * @param array|callable $rest
- * @refcount 1
  */
 function array_uintersect(array $array, ...$rest): array {}
 
@@ -1795,13 +1790,11 @@
 
 /**
  * @param array|callable $rest
- * @refcount 1
  */
 function array_intersect_uassoc(array $array, ...$rest): array {}
 
 /**
  * @param array|callable $rest
- * @refcount 1
  */
 function array_uintersect_uassoc(array $array, ...$rest): array {}
 
diff -Nru php8.4-8.4.10/ext/standard/formatted_print.c php8.4-8.4.11/ext/standard/formatted_print.c
--- php8.4-8.4.10/ext/standard/formatted_print.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/formatted_print.c	2025-07-29 17:30:21.000000000 +0200
@@ -49,10 +49,10 @@
 php_sprintf_appendchar(zend_string **buffer, size_t *pos, char add)
 {
 	if ((*pos + 1) >= ZSTR_LEN(*buffer)) {
-		PRINTF_DEBUG(("%s(): ereallocing buffer to %d bytes\n", get_active_function_name(), ZSTR_LEN(*buffer)));
+		PRINTF_DEBUG(("%s(): ereallocing buffer to %zu bytes\n", get_active_function_name(), ZSTR_LEN(*buffer)));
 		*buffer = zend_string_extend(*buffer, ZSTR_LEN(*buffer) << 1, 0);
 	}
-	PRINTF_DEBUG(("sprintf: appending '%c', pos=\n", add, *pos));
+	PRINTF_DEBUG(("sprintf: appending '%c', pos=%zu\n", add, *pos));
 	ZSTR_VAL(*buffer)[(*pos)++] = add;
 }
 /* }}} */
@@ -64,13 +64,13 @@
 	if ((*pos + len) >= ZSTR_LEN(*buffer)) {
 		size_t nlen = ZSTR_LEN(*buffer);
 
-		PRINTF_DEBUG(("%s(): ereallocing buffer to %d bytes\n", get_active_function_name(), ZSTR_LEN(*buffer)));
+		PRINTF_DEBUG(("%s(): ereallocing buffer to %zu bytes\n", get_active_function_name(), ZSTR_LEN(*buffer)));
 		do {
 			nlen = nlen << 1;
 		} while ((*pos + len) >= nlen);
 		*buffer = zend_string_extend(*buffer, nlen, 0);
 	}
-	PRINTF_DEBUG(("sprintf: appending \"%s\", pos=\n", add, *pos));
+	PRINTF_DEBUG(("sprintf: appending \"%s\", pos=%zu\n", add, *pos));
 	memcpy(ZSTR_VAL(*buffer) + (*pos), add, len);
 	*pos += len;
 }
@@ -90,7 +90,7 @@
 	copy_len = (expprec ? MIN(max_width, len) : len);
 	npad = (min_width < copy_len) ? 0 : min_width - copy_len;
 
-	PRINTF_DEBUG(("sprintf: appendstring(%x, %d, %d, \"%s\", %d, '%c', %d)\n",
+	PRINTF_DEBUG(("sprintf: appendstring(%p, %zu, %zu, \"%s\", %zu, '%c', %zu)\n",
 				  *buffer, *pos, ZSTR_LEN(*buffer), add, min_width, padding, alignment));
 	m_width = MAX(min_width, copy_len);
 
@@ -108,7 +108,7 @@
 			}
 			size <<= 1;
 		}
-		PRINTF_DEBUG(("sprintf ereallocing buffer to %d bytes\n", size));
+		PRINTF_DEBUG(("sprintf ereallocing buffer to %zu bytes\n", size));
 		*buffer = zend_string_extend(*buffer, size, 0);
 	}
 	if (alignment == ALIGN_RIGHT) {
@@ -143,8 +143,8 @@
 	zend_ulong magn, nmagn;
 	unsigned int i = NUM_BUF_SIZE - 1, neg = 0;
 
-	PRINTF_DEBUG(("sprintf: appendint(%x, %x, %x, %d, %d, '%c', %d)\n",
-				  *buffer, pos, &ZSTR_LEN(*buffer), number, width, padding, alignment));
+	PRINTF_DEBUG(("sprintf: appendint(%p, %zu, %zu, " ZEND_LONG_FMT ", %zu, '%c', %zu)\n",
+				  *buffer, *pos, ZSTR_LEN(*buffer), number, width, padding, alignment));
 	if (number < 0) {
 		neg = 1;
 		magn = ((zend_ulong) -(number + 1)) + 1;
@@ -169,7 +169,7 @@
 	} else if (always_sign) {
 		numbuf[--i] = '+';
 	}
-	PRINTF_DEBUG(("sprintf: appending %d as \"%s\", i=%d\n",
+	PRINTF_DEBUG(("sprintf: appending " ZEND_LONG_FMT " as \"%s\", i=%u\n",
 				  number, &numbuf[i], i));
 	php_sprintf_appendstring(buffer, pos, &numbuf[i], width, 0,
 							 padding, alignment, (NUM_BUF_SIZE - 1) - i,
@@ -187,8 +187,8 @@
 	zend_ulong magn, nmagn;
 	unsigned int i = NUM_BUF_SIZE - 1;
 
-	PRINTF_DEBUG(("sprintf: appenduint(%x, %x, %x, %d, %d, '%c', %d)\n",
-				  *buffer, pos, &ZSTR_LEN(*buffer), number, width, padding, alignment));
+	PRINTF_DEBUG(("sprintf: appenduint(%p, %zu, %zu, " ZEND_LONG_FMT ", %zu, '%c', %zu)\n",
+				  *buffer, *pos, ZSTR_LEN(*buffer), number, width, padding, alignment));
 	magn = (zend_ulong) number;
 
 	/* Can't right-pad 0's on integers */
@@ -203,7 +203,7 @@
 		magn = nmagn;
 	} while (magn > 0 && i > 0);
 
-	PRINTF_DEBUG(("sprintf: appending %d as \"%s\", i=%d\n", number, &numbuf[i], i));
+	PRINTF_DEBUG(("sprintf: appending " ZEND_LONG_FMT " as \"%s\", i=%d\n", number, &numbuf[i], i));
 	php_sprintf_appendstring(buffer, pos, &numbuf[i], width, 0,
 							 padding, alignment, (NUM_BUF_SIZE - 1) - i, /* neg */ false, 0, 0);
 }
@@ -229,8 +229,8 @@
 	struct lconv *lconv;
 #endif
 
-	PRINTF_DEBUG(("sprintf: appenddouble(%x, %x, %x, %f, %d, '%c', %d, %c)\n",
-				  *buffer, pos, &ZSTR_LEN(*buffer), number, width, padding, alignment, fmt));
+	PRINTF_DEBUG(("sprintf: appenddouble(%p, %zu, %zu, %f, %zu, '%c', %zu, %c)\n",
+				  *buffer, *pos, ZSTR_LEN(*buffer), number, width, padding, alignment, fmt));
 	if ((adjust & ADJ_PRECISION) == 0) {
 		precision = FLOAT_PRECISION;
 	} else if (precision > MAX_FLOAT_PRECISION) {
@@ -328,8 +328,8 @@
 	zend_ulong  i = NUM_BUF_SIZE - 1;
 	int andbits = (1 << n) - 1;
 
-	PRINTF_DEBUG(("sprintf: append2n(%x, %x, %x, %d, %d, '%c', %d, %d, %x)\n",
-				  *buffer, pos, &ZSTR_LEN(*buffer), number, width, padding, alignment, n,
+	PRINTF_DEBUG(("sprintf: append2n(%p, %zu, %zu, " ZEND_LONG_FMT ", %zu, '%c', %zu, %d, %p)\n",
+				  *buffer, *pos, ZSTR_LEN(*buffer), number, width, padding, alignment, n,
 				  chartable));
 	PRINTF_DEBUG(("sprintf: append2n 2^%d andbits=%x\n", n, andbits));
 
@@ -361,7 +361,7 @@
 		*len -= i;
 		*buffer = endptr;
 	}
-	PRINTF_DEBUG(("sprintf_getnumber: number was %d bytes long\n", i));
+	PRINTF_DEBUG(("sprintf_getnumber: number was %zu bytes long\n", i));
 
 	if (num >= INT_MAX || num < 0) {
 		return -1;
@@ -429,6 +429,10 @@
 	int always_sign;
 	int max_missing_argnum = -1;
 
+	/* For debugging */
+	const char *format_orig = format;
+	ZEND_IGNORE_VALUE(format_orig);
+
 	result = zend_string_alloc(size, 0);
 
 	currarg = 0;
@@ -462,8 +466,8 @@
 			always_sign = 0;
 			expprec = 0;
 
-			PRINTF_DEBUG(("sprintf: first looking at '%c', inpos=%d\n",
-						  *format, format - Z_STRVAL_P(z_format)));
+			PRINTF_DEBUG(("sprintf: first looking at '%c', inpos=%zu\n",
+						  *format, format - format_orig));
 			if (isalpha((int)*format)) {
 				width = precision = 0;
 				argnum = ARG_NUM_NEXT;
@@ -476,8 +480,8 @@
 
 				/* after argnum comes modifiers */
 				PRINTF_DEBUG(("sprintf: looking for modifiers\n"
-							  "sprintf: now looking at '%c', inpos=%d\n",
-							  *format, format - Z_STRVAL_P(z_format)));
+							  "sprintf: now looking at '%c', inpos=%zu\n",
+							  *format, format - format_orig));
 				for (;; format++, format_len--) {
 					if (*format == ' ' || *format == '0') {
 						padding = *format;
@@ -528,7 +532,7 @@
 						goto fail;
 					}
 					if (Z_LVAL_P(tmp) < 0 || Z_LVAL_P(tmp) > INT_MAX) {
-						zend_value_error("Width must be greater than zero and less than %d", INT_MAX);
+						zend_value_error("Width must be between 0 and %d", INT_MAX);
 						goto fail;
 					}
 					width = Z_LVAL_P(tmp);
@@ -536,7 +540,7 @@
 				} else if (isdigit((int)*format)) {
 					PRINTF_DEBUG(("sprintf: getting width\n"));
 					if ((width = php_sprintf_getnumber(&format, &format_len)) < 0) {
-						zend_value_error("Width must be greater than zero and less than %d", INT_MAX);
+						zend_value_error("Width must be between 0 and %d", INT_MAX);
 						goto fail;
 					}
 					adjusting |= ADJ_WIDTH;
@@ -580,7 +584,7 @@
 						expprec = 1;
 					} else if (isdigit((int)*format)) {
 						if ((precision = php_sprintf_getnumber(&format, &format_len)) < 0) {
-							zend_value_error("Precision must be greater than zero and less than %d", INT_MAX);
+							zend_value_error("Precision must be between 0 and %d", INT_MAX);
 							goto fail;
 						}
 						adjusting |= ADJ_PRECISION;
diff -Nru php8.4-8.4.10/ext/standard/pack.c php8.4-8.4.11/ext/standard/pack.c
--- php8.4-8.4.10/ext/standard/pack.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/pack.c	2025-07-29 17:30:21.000000000 +0200
@@ -386,7 +386,7 @@
 		switch ((int) code) {
 			case 'h':
 			case 'H':
-				INC_OUTPUTPOS((arg + (arg % 2)) / 2,1)	/* 4 bit per arg */
+				INC_OUTPUTPOS((arg / 2) + (arg % 2),1)	/* 4 bit per arg */
 				break;
 
 			case 'a':
diff -Nru php8.4-8.4.10/ext/standard/tests/array/rcn_in_place.phpt php8.4-8.4.11/ext/standard/tests/array/rcn_in_place.phpt
--- php8.4-8.4.10/ext/standard/tests/array/rcn_in_place.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/standard/tests/array/rcn_in_place.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,57 @@
+--TEST--
+RCN check for in-place array modifications
+--FILE--
+<?php
+// Important: do NOT replace range(0, 1) with a variable, these NEED to be TMPVARs!
+var_dump(array_replace(range(0, 1), []));
+var_dump(array_replace_recursive(range(0, 1), []));
+var_dump(array_merge(range(0, 1), []));
+var_dump(array_merge_recursive(range(0, 1), []));
+var_dump(array_unique(range(0, 1)));
+var_dump(array_intersect_ukey(range(0, 1), [], fn () => 0));
+var_dump(array_intersect(range(0, 1), []));
+var_dump(array_uintersect(range(0, 1), [], fn () => 0));
+var_dump(array_intersect_uassoc(range(0, 1), [], fn () => 0));
+var_dump(array_uintersect_uassoc(range(0, 1), [], fn () => 0, fn () => 0));
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+}
+array(2) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+}
+array(2) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+}
+array(2) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+}
+array(2) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
diff -Nru php8.4-8.4.10/ext/standard/tests/filters/gh13264.phpt php8.4-8.4.11/ext/standard/tests/filters/gh13264.phpt
--- php8.4-8.4.10/ext/standard/tests/filters/gh13264.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/tests/filters/gh13264.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -1,49 +1,57 @@
 --TEST--
-GH-81475: Memory leak during stream filter failure
+GH-13264: fgets() and stream_get_line() do not return false on filter fatal error
 --SKIPIF--
 <?php require 'filter_errors.inc'; filter_errors_skipif('zlib.inflate'); ?>
 --FILE--
 <?php
-// Prepare a big enough input so that it is not entirely buffered
-$stream = fopen('php://memory', 'r+');
-$content = '';
-for ($i = 0; $i < 10000; $i++) {
-	$content .= "Hello $i\n";
-}
-fwrite($stream, gzcompress($content));
-
-// Mess up the checksum
-fseek($stream, -1, SEEK_CUR);
-fwrite($stream, '1');
+function create_stream()
+{
+    // Prepare a big enough input so that it is not entirely buffered
+    $stream = fopen('php://memory', 'r+');
+    $content = '';
+    for ($i = 0; $i < 10000; $i++) {
+        $content .= "Hello $i\n";
+    }
+    fwrite($stream, gzcompress($content));
+
+    // Mess up the checksum
+    fseek($stream, -1, SEEK_CUR);
+    fwrite($stream, '1');
+
+    // Rewind and add the zlib filter
+    rewind($stream);
+    stream_filter_append($stream, 'zlib.inflate', STREAM_FILTER_READ, ['window' => 15]);
 
-// Rewind and add the zlib filter
-rewind($stream);
-stream_filter_append($stream, 'zlib.inflate', STREAM_FILTER_READ, ['window' => 15]);
+    return $stream;
+}
 
-// Read the filtered stream line by line.
+// Read the filtered stream line by line using fgets.
+$stream = create_stream();
 while (($line = fgets($stream)) !== false) {
-	$error = error_get_last();
-	if ($error !== null) {
-		// An error is thrown but fgets didn't return false
-		var_dump(error_get_last());
-		var_dump($line);
-	}
+    $error = error_get_last();
+    if ($error !== null) {
+        // An error is thrown but fgets didn't return false
+        var_dump(error_get_last());
+        var_dump($line);
+    }
 }
+fclose($stream);
+error_clear_last();
 
+// Read the filtered stream line by line using stream_get_line.
+$stream = create_stream();
+while (($line = stream_get_line($stream, 0, "\n")) !== false) {
+    $error = error_get_last();
+    if ($error !== null) {
+        // An error is thrown but stream_get_line didn't return false
+        var_dump(error_get_last());
+        var_dump($line);
+    }
+}
 fclose($stream);
 ?>
 --EXPECTF--
 
 Notice: fgets(): zlib: data error in %s on line %d
-array(4) {
-  ["type"]=>
-  int(8)
-  ["message"]=>
-  string(25) "fgets(): zlib: data error"
-  ["file"]=>
-  string(%d) "%s"
-  ["line"]=>
-  int(%d)
-}
-string(%d) "Hello%s"
 
+Notice: stream_get_line(): zlib: data error in %s on line %d
diff -Nru php8.4-8.4.10/ext/standard/tests/streams/bug61371.phpt php8.4-8.4.11/ext/standard/tests/streams/bug61371.phpt
--- php8.4-8.4.10/ext/standard/tests/streams/bug61371.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/tests/streams/bug61371.phpt	1970-01-01 01:00:00.000000000 +0100
@@ -1,40 +0,0 @@
---TEST--
-Bug #61371: stream_context_create() causes memory leaks on use streams_socket_create
---FILE--
-<?php
-function test($doFclose) {
-$previous = null;
-$current = null;
-for($test=1;$test<=3;$test++) {
-    $current = memory_get_usage(true);
-    if (!is_null($previous)) {
-        var_dump($previous == $current);
-    }
-    $previous = $current;
-    echo 'memory: '.round($current / 1024, 0)."kb\n";
-    for($i=0;$i<=100;$i++) {
-        $context = stream_context_create(array());
-        $stream = stream_socket_client('udp://127.0.0.1:80', $errno, $errstr, 10, STREAM_CLIENT_CONNECT, $context);
-        if ($doFclose) fclose($stream);
-        unset($context);
-        unset($stream);
-        unset($errno);
-        unset($errstr);
-    }
-}
-}
-
-test(true);
-test(false);
-?>
---EXPECTF--
-memory: %dkb
-bool(true)
-memory: %dkb
-bool(true)
-memory: %dkb
-memory: %dkb
-bool(true)
-memory: %dkb
-bool(true)
-memory: %dkb
diff -Nru php8.4-8.4.10/ext/standard/tests/streams/bug61371-unix.phpt php8.4-8.4.11/ext/standard/tests/streams/bug61371-unix.phpt
--- php8.4-8.4.10/ext/standard/tests/streams/bug61371-unix.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/tests/streams/bug61371-unix.phpt	1970-01-01 01:00:00.000000000 +0100
@@ -1,46 +0,0 @@
---TEST--
-Bug #61371: stream_context_create() causes memory leaks on use streams_socket_create
---SKIPIF--
-<?php
-if(substr(PHP_OS, 0, 3) == 'WIN' ) {
-    die('skip non windows test');
-}
-?>
---FILE--
-<?php
-function test($doFclose) {
-$previous = null;
-$current = null;
-for($test=1;$test<=3;$test++) {
-    $current = memory_get_usage(true);
-    if (!is_null($previous)) {
-        var_dump($previous == $current);
-    }
-    $previous = $current;
-    echo 'memory: '.round($current / 1024, 0)."kb\n";
-    for($i=0;$i<=100;$i++) {
-        $context = stream_context_create(array());
-        $stream = stream_socket_client('udp://0.0.0.0:80', $errno, $errstr, 10, STREAM_CLIENT_CONNECT, $context);
-        if ($doFclose) fclose($stream);
-        unset($context);
-        unset($stream);
-        unset($errno);
-        unset($errstr);
-    }
-}
-}
-
-test(true);
-test(false);
-?>
---EXPECTF--
-memory: %dkb
-bool(true)
-memory: %dkb
-bool(true)
-memory: %dkb
-memory: %dkb
-bool(true)
-memory: %dkb
-bool(true)
-memory: %dkb
diff -Nru php8.4-8.4.10/ext/standard/tests/strings/gh18976.phpt php8.4-8.4.11/ext/standard/tests/strings/gh18976.phpt
--- php8.4-8.4.10/ext/standard/tests/strings/gh18976.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/ext/standard/tests/strings/gh18976.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,14 @@
+--TEST--
+GH-18976 (pack overflow with h/H format)
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+pack('h2147483647', 1);
+pack('H2147483647', 1);
+?>
+--EXPECTF--
+
+Warning: pack(): Type h: not enough characters in string in %s on line %d
+
+Warning: pack(): Type H: not enough characters in string in %s on line %d
diff -Nru php8.4-8.4.10/ext/standard/tests/strings/sprintf_star.phpt php8.4-8.4.11/ext/standard/tests/strings/sprintf_star.phpt
--- php8.4-8.4.10/ext/standard/tests/strings/sprintf_star.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/standard/tests/strings/sprintf_star.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -62,6 +62,18 @@
     echo $e->getMessage(), "\n";
 }
 
+try {
+    printf("%9999999999999999999999.f\n", $f);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+
+try {
+    printf("%.9999999999999999999999f\n", $f);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+
 ?>
 --EXPECT--
 float(1.2345678901234567)
@@ -95,4 +107,6 @@
 Precision must be an integer
 Precision must be between -1 and 2147483647
 Precision -1 is only supported for %g, %G, %h and %H
-Width must be greater than zero and less than 2147483647
+Width must be between 0 and 2147483647
+Width must be between 0 and 2147483647
+Precision must be between 0 and 2147483647
diff -Nru php8.4-8.4.10/ext/zip/php_zip.c php8.4-8.4.11/ext/zip/php_zip.c
--- php8.4-8.4.10/ext/zip/php_zip.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/ext/zip/php_zip.c	2025-07-29 17:30:21.000000000 +0200
@@ -217,6 +217,7 @@
 		return 0;
 	} else if (len > MAXPATHLEN) {
 		php_error_docref(NULL, E_WARNING, "Full extraction path exceed MAXPATHLEN (%i)", MAXPATHLEN);
+		efree(fullpath);
 		efree(file_dirname_fullpath);
 		zend_string_release_ex(file_basename, 0);
 		CWD_STATE_FREE(new_state.cwd);
diff -Nru php8.4-8.4.10/.github/actions/freebsd/action.yml php8.4-8.4.11/.github/actions/freebsd/action.yml
--- php8.4-8.4.10/.github/actions/freebsd/action.yml	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/.github/actions/freebsd/action.yml	2025-07-29 17:30:21.000000000 +0200
@@ -1,4 +1,8 @@
 name: FreeBSD
+inputs:
+  configurationParameters:
+    default: ''
+    required: false
 runs:
   using: composite
   steps:
@@ -80,7 +84,9 @@
             --with-sodium \
             --enable-werror \
             --with-config-file-path=/etc \
-            --with-config-file-scan-dir=/etc/php.d
+            --with-config-file-scan-dir=/etc/php.d \
+            ${{ inputs.configurationParameters }}
+
           gmake -j2
           mkdir /etc/php.d
           gmake install > /dev/null
diff -Nru php8.4-8.4.10/.github/scripts/windows/build.bat php8.4-8.4.11/.github/scripts/windows/build.bat
--- php8.4-8.4.10/.github/scripts/windows/build.bat	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/.github/scripts/windows/build.bat	2025-07-29 17:30:21.000000000 +0200
@@ -41,7 +41,9 @@
 	exit /b 3
 )
 
-cmd /c %SDK_RUNNER% -t .github\scripts\windows\build_task.bat
+for /f "delims=" %%T in ('call .github\scripts\windows\find-vs-toolset.bat %PHP_BUILD_CRT%') do set "VS_TOOLSET=%%T"
+echo Got VS Toolset %VS_TOOLSET%
+cmd /c %SDK_RUNNER% -s %VS_TOOLSET% -t .github\scripts\windows\build_task.bat
 if %errorlevel% neq 0 exit /b 3
 
 exit /b 0
diff -Nru php8.4-8.4.10/.github/scripts/windows/find-vs-toolset.bat php8.4-8.4.11/.github/scripts/windows/find-vs-toolset.bat
--- php8.4-8.4.10/.github/scripts/windows/find-vs-toolset.bat	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/.github/scripts/windows/find-vs-toolset.bat	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,49 @@
+@echo off
+
+setlocal enabledelayedexpansion
+
+if "%~1"=="" (
+  echo ERROR: Usage: %~nx0 [vc14^|vc15^|vs16^|vs17]
+  exit /b 1
+)
+
+set "toolsets_vc14=14.0"
+set "toolsets_vc15="
+set "toolsets_vs16="
+set "toolsets_vs17="
+
+
+for /f "usebackq tokens=*" %%I in (`vswhere.exe -latest -find "VC\Tools\MSVC"`) do set "MSVCDIR=%%I"
+
+if not defined MSVCDIR (
+  echo ERROR: could not locate VC\Tools\MSVC
+  exit /b 1
+)
+
+for /f "delims=" %%D in ('dir /b /ad "%MSVCDIR%"') do (
+  for /f "tokens=1,2 delims=." %%A in ("%%D") do (
+    set "maj=%%A" & set "min=%%B"
+    if "!maj!"=="14" (
+      if !min! LEQ 9 (
+        set "toolsets_vc14=%%D"
+      ) else if !min! LEQ 19 (
+        set "toolsets_vc15=%%D"
+      ) else if !min! LEQ 29 (
+        set "toolsets_vs16=%%D"
+      ) else (
+        set "toolsets_vs17=%%D"
+      )
+    )
+  )
+)
+
+set "KEY=%~1"
+set "VAR=toolsets_%KEY%"
+call set "RESULT=%%%VAR%%%"
+if defined RESULT (
+  echo %RESULT%
+  exit /b 0
+) else (
+  echo ERROR: no toolset found for %KEY%
+  exit /b 1
+)
diff -Nru php8.4-8.4.10/.github/scripts/windows/test.bat php8.4-8.4.11/.github/scripts/windows/test.bat
--- php8.4-8.4.10/.github/scripts/windows/test.bat	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/.github/scripts/windows/test.bat	2025-07-29 17:30:21.000000000 +0200
@@ -9,7 +9,8 @@
 	exit /b 3
 )
 
-cmd /c %SDK_RUNNER% -t .github\scripts\windows\test_task.bat
+for /f "delims=" %%T in ('call .github\scripts\windows\find-vs-toolset.bat %PHP_BUILD_CRT%') do set "VS_TOOLSET=%%T"
+cmd /c %SDK_RUNNER% -s %VS_TOOLSET% -t .github\scripts\windows\test_task.bat
 if %errorlevel% neq 0 exit /b 3
 
 exit /b 0
diff -Nru php8.4-8.4.10/.github/workflows/nightly.yml php8.4-8.4.11/.github/workflows/nightly.yml
--- php8.4-8.4.10/.github/workflows/nightly.yml	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/.github/workflows/nightly.yml	2025-07-29 17:30:21.000000000 +0200
@@ -23,12 +23,18 @@
       run_macos_arm64:
         required: true
         type: boolean
+      run_freebsd_zts:
+        required: true
+        type: boolean
       ubuntu_version:
         required: true
         type: string
       windows_version:
         required: true
         type: string
+      vs_crt_version:
+        required: true
+        type: string
       skip_laravel:
         required: true
         type: boolean
@@ -1031,7 +1037,7 @@
       PHP_BUILD_OBJ_DIR: C:\obj
       PHP_BUILD_CACHE_SDK_DIR: C:\build-cache\sdk
       PHP_BUILD_SDK_BRANCH: php-sdk-2.3.0
-      PHP_BUILD_CRT: ${{ inputs.windows_version == '2022' && 'vs17' || 'vs16' }}
+      PHP_BUILD_CRT: ${{ inputs.vs_crt_version }}
       PLATFORM: ${{ matrix.x64 && 'x64' || 'x86' }}
       THREAD_SAFE: "${{ matrix.zts && '1' || '0' }}"
       INTRINSICS: "${{ matrix.zts && 'AVX2' || '' }}"
@@ -1052,7 +1058,13 @@
       - name: Test
         run: .github/scripts/windows/test.bat
   FREEBSD:
-    name: FREEBSD
+    strategy:
+      fail-fast: false
+      matrix:
+        zts: [true, false]
+        exclude:
+          - zts: ${{ !inputs.run_freebsd_zts && true || '*never*' }}
+    name: "FREEBSD_${{ matrix.zts && 'ZTS' || 'NTS' }}"
     runs-on: ubuntu-latest
     steps:
       - name: git checkout
@@ -1061,3 +1073,6 @@
           ref: ${{ inputs.branch }}
       - name: FreeBSD
         uses: ./.github/actions/freebsd
+        with:
+          configurationParameters: >-
+            --${{ matrix.zts && 'enable' || 'disable' }}-zts
diff -Nru php8.4-8.4.10/.github/workflows/root.yml php8.4-8.4.11/.github/workflows/root.yml
--- php8.4-8.4.10/.github/workflows/root.yml	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/.github/workflows/root.yml	2025-07-29 17:30:21.000000000 +0200
@@ -55,10 +55,12 @@
       run_alpine: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) || matrix.branch.version[0] >= 9 }}
       run_linux_ppc64: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) || matrix.branch.version[0] >= 9 }}
       run_macos_arm64: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) || matrix.branch.version[0] >= 9 }}
+      run_freebsd_zts: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 3) || matrix.branch.version[0] >= 9 }}
       ubuntu_version: ${{
         (((matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 5) || matrix.branch.version[0] >= 9) && '24.04')
         || '22.04' }}
-      windows_version: ${{ ((matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) || matrix.branch.version[0] >= 9) && '2022' || '2019' }}
+      windows_version: '2022'
+      vs_crt_version: ${{ ((matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) && 'vs17') || 'vs16' }}
       skip_laravel: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}
       skip_symfony: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}
       skip_wordpress: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}
diff -Nru php8.4-8.4.10/main/php_streams.h php8.4-8.4.11/main/php_streams.h
--- php8.4-8.4.10/main/php_streams.h	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/main/php_streams.h	2025-07-29 17:30:21.000000000 +0200
@@ -219,6 +219,9 @@
 	/* whether stdio cast flushing is in progress */
 	uint16_t fclose_stdiocast_flush_in_progress:1;
 
+	/* whether fatal error happened and all operations should terminates as soon as possible */
+	uint16_t fatal_error:1;
+
 	char mode[16];			/* "rwb" etc. ala stdio */
 
 	uint32_t flags;	/* PHP_STREAM_FLAG_XXX */
diff -Nru php8.4-8.4.10/main/php_version.h php8.4-8.4.11/main/php_version.h
--- php8.4-8.4.10/main/php_version.h	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/main/php_version.h	2025-07-29 17:30:21.000000000 +0200
@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 8
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 10
+#define PHP_RELEASE_VERSION 11
 #define PHP_EXTRA_VERSION ""
-#define PHP_VERSION "8.4.10"
-#define PHP_VERSION_ID 80410
+#define PHP_VERSION "8.4.11"
+#define PHP_VERSION_ID 80411
diff -Nru php8.4-8.4.10/main/streams/memory.c php8.4-8.4.11/main/streams/memory.c
--- php8.4-8.4.10/main/streams/memory.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/main/streams/memory.c	2025-07-29 17:30:21.000000000 +0200
@@ -136,10 +136,12 @@
 					ms->fpos = ms->fpos + offset;
 					*newoffs = ms->fpos;
 					stream->eof = 0;
+					stream->fatal_error = 0;
 					return 0;
 				}
 			} else {
 				stream->eof = 0;
+				stream->fatal_error = 0;
 				ms->fpos = ms->fpos + offset;
 				*newoffs = ms->fpos;
 				return 0;
@@ -153,6 +155,7 @@
 				ms->fpos = offset;
 				*newoffs = ms->fpos;
 				stream->eof = 0;
+				stream->fatal_error = 0;
 				return 0;
 			}
 		case SEEK_END:
@@ -160,6 +163,7 @@
 				ms->fpos = ZSTR_LEN(ms->data) + offset;
 				*newoffs = ms->fpos;
 				stream->eof = 0;
+				stream->fatal_error = 0;
 				return 0;
 			} else if (ZSTR_LEN(ms->data) < (size_t)(-offset)) {
 				ms->fpos = 0;
@@ -169,6 +173,7 @@
 				ms->fpos = ZSTR_LEN(ms->data) + offset;
 				*newoffs = ms->fpos;
 				stream->eof = 0;
+				stream->fatal_error = 0;
 				return 0;
 			}
 		default:
diff -Nru php8.4-8.4.10/main/streams/streams.c php8.4-8.4.11/main/streams/streams.c
--- php8.4-8.4.10/main/streams/streams.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/main/streams/streams.c	2025-07-29 17:30:21.000000000 +0200
@@ -636,6 +636,7 @@
 					/* some fatal error. Theoretically, the stream is borked, so all
 					 * further reads should fail. */
 					stream->eof = 1;
+					stream->fatal_error = 1;
 					/* free all data left in brigades */
 					while ((bucket = brig_inp->head)) {
 						/* Remove unconsumed buckets from the input brigade */
@@ -1009,7 +1010,12 @@
 				}
 			}
 
-			php_stream_fill_read_buffer(stream, toread);
+			if (php_stream_fill_read_buffer(stream, toread) == FAILURE && stream->fatal_error) {
+				if (grow_mode) {
+					efree(bufstart);
+				}
+				return NULL;
+			}
 
 			if (stream->writepos - stream->readpos == 0) {
 				break;
@@ -1084,7 +1090,9 @@
 
 		to_read_now = MIN(maxlen - buffered_len, stream->chunk_size);
 
-		php_stream_fill_read_buffer(stream, buffered_len + to_read_now);
+		if (php_stream_fill_read_buffer(stream, buffered_len + to_read_now) == FAILURE && stream->fatal_error) {
+			return NULL;
+		}
 
 		just_read = STREAM_BUFFERED_AMOUNT(stream) - buffered_len;
 
@@ -1357,6 +1365,7 @@
 					stream->readpos += offset; /* if offset = ..., then readpos = writepos */
 					stream->position += offset;
 					stream->eof = 0;
+					stream->fatal_error = 0;
 					return 0;
 				}
 				break;
@@ -1366,6 +1375,7 @@
 					stream->readpos += offset - stream->position;
 					stream->position = offset;
 					stream->eof = 0;
+					stream->fatal_error = 0;
 					return 0;
 				}
 				break;
@@ -1400,6 +1410,7 @@
 		if (((stream->flags & PHP_STREAM_FLAG_NO_SEEK) == 0) || ret == 0) {
 			if (ret == 0) {
 				stream->eof = 0;
+				stream->fatal_error = 0;
 			}
 
 			/* invalidate the buffer contents */
@@ -1422,6 +1433,7 @@
 			offset -= didread;
 		}
 		stream->eof = 0;
+		stream->fatal_error = 0;
 		return 0;
 	}
 
diff -Nru php8.4-8.4.10/NEWS php8.4-8.4.11/NEWS
--- php8.4-8.4.10/NEWS	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/NEWS	2025-07-29 17:30:21.000000000 +0200
@@ -1,5 +1,80 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+31 Jul 2025, PHP 8.4.11
+
+- Calendar:
+  . Fixed jewishtojd overflow on year argument. (David Carlier)
+
+- Core:
+  . Fixed bug GH-18833 (Use after free with weakmaps dependent on destruction
+    order). (Daniil Gentili)
+  . Fixed bug GH-18907 (Leak when creating cycle in hook). (ilutov)
+  . Fix OSS-Fuzz #427814456. (nielsdos)
+  . Fix OSS-Fuzz #428983568 and #428760800. (nielsdos)
+  . Fixed bug GH-17204 (-Wuseless-escape warnings emitted by re2c). (Peter Kokot)
+  . Fixed bug GH-19064 (Undefined symbol 'execute_ex' on Windows ARM64).
+    (Demon)
+
+- Curl:
+  . Fix memory leaks when returning refcounted value from curl callback.
+    (nielsdos)
+  . Remove incorrect string release. (nielsdos)
+
+- DOM:
+  . Fixed bug GH-18979 (Dom\XMLDocument::createComment() triggers undefined
+    behavior with null byte). (nielsdos)
+
+- LDAP:
+  . Fixed GH-18902 ldap_exop/ldap_exop_sync assert triggered on empty
+    request OID. (David Carlier)
+
+- MbString:
+  . Fixed bug GH-18901 (integer overflow mb_split). (nielsdos)
+
+- Opcache:
+  . Fixed bug GH-18639 (Internal class aliases can break preloading + JIT).
+    (nielsdos)
+  . Fixed bug GH-18899 (JIT function crash when emitting undefined variable
+    warning and opline is not set yet). (nielsdos)
+  . Fixed bug GH-14082 (Segmentation fault on unknown address 0x600000000018
+    in ext/opcache/jit/zend_jit.c). (nielsdos)
+  . Fixed bug GH-18898 (SEGV zend_jit_op_array_hot with property hooks
+    and preloading). (nielsdos)
+
+- OpenSSL:
+  . Fixed bug #80770 (It is not possible to get client peer certificate with
+    stream_socket_server). (Jakub Zelenka)
+
+- PCNTL:
+  . Fixed bug GH-18958 (Fatal error during shutdown after pcntl_rfork() or
+    pcntl_forkx() with zend-max-execution-timers). (Arnaud)
+
+- Phar:
+  . Fix stream double free in phar. (nielsdos, dixyes)
+  . Fix phar crash and file corruption with SplFileObject. (nielsdos)
+
+- SOAP:
+  . Fixed bug GH-18990, bug #81029, bug #47314 (SOAP HTTP socket not closing
+    on object destruction). (nielsdos)
+  . Fix memory leak when URL parsing fails in redirect. (Girgias)
+
+- SPL:
+  . Fixed bug GH-19094 (Attaching class with no Iterator implementation to
+    MultipleIterator causes crash). (nielsdos)
+
+- Standard:
+  . Fix misleading errors in printf(). (nielsdos)
+  . Fix RCN violations in array functions. (nielsdos)
+  . Fixed GH-18976 pack() overflow with h/H format and INT_MAX repeater value.
+    (David Carlier)
+
+- Streams:
+  . Fixed GH-13264 (fgets() and stream_get_line() do not return false on filter
+    fatal error). (Jakub Zelenka)
+
+- Zip:
+  . Fix leak when path is too long in ZipArchive::extractTo(). (nielsdos)
+
 03 Jul 2025, PHP 8.4.10
 
 - BcMath:
@@ -49,10 +124,6 @@
   . Fixed bug #74796 (Requests through http proxy set peer name).
     (Jakub Zelenka)
 
-- PGSQL:
-  . Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during
-    escaping). (CVE-2025-1735) (Jakub Zelenka)
-
 - PDO ODBC:
   . Fix memory leak if WideCharToMultiByte() fails. (nielsdos)
 
@@ -83,14 +154,8 @@
   . Fixed bug GH-18597 (Heap-buffer-overflow in zend_alloc.c when assigning
     string with UTF-8 bytes). (nielsdos)
 
-- SOAP:
+- Soap:
   . Fix memory leaks in php_http.c when call_user_function() fails. (nielsdos)
-  . Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension
-    via Large XML Namespace Prefix). (CVE-2025-6491) (Lekssays, nielsdos)
-
-- Standard:
-  . Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames).
-    (CVE-2025-1220) (Jakub Zelenka)
 
 - Tidy:
   . Fix memory leak in tidy output handler on error. (nielsdos)
diff -Nru php8.4-8.4.10/sapi/phpdbg/phpdbg_lexer.l php8.4-8.4.11/sapi/phpdbg/phpdbg_lexer.l
--- php8.4-8.4.10/sapi/phpdbg/phpdbg_lexer.l	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/sapi/phpdbg/phpdbg_lexer.l	2025-07-29 17:30:21.000000000 +0200
@@ -77,7 +77,7 @@
 T_RUN       'run'
 T_RUN_SHORT "r"
 WS          [ \r\t]+
-DIGITS      [-]?[0-9\.]+
+DIGITS      [-]?[0-9.]+
 ID          [^ \r\n\t:#\000]+
 GENERIC_ID  ([^ \r\n\t:#\000"']|":\\")+|["]([^\n\000"\\]|"\\\\"|"\\"["])+["]|[']([^\n\000'\\]|"\\\\"|"\\"['])+[']
 ADDR        [0][x][a-fA-F0-9]+
diff -Nru php8.4-8.4.10/tests/basic/timeout_variation_0.phpt php8.4-8.4.11/tests/basic/timeout_variation_0.phpt
--- php8.4-8.4.10/tests/basic/timeout_variation_0.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/tests/basic/timeout_variation_0.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -2,6 +2,9 @@
 Timeout within while loop
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows' && version_compare(PHP_VERSION, '8.4', '<')) {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
 ?>
 --FILE--
diff -Nru php8.4-8.4.10/tests/basic/timeout_variation_7.phpt php8.4-8.4.11/tests/basic/timeout_variation_7.phpt
--- php8.4-8.4.10/tests/basic/timeout_variation_7.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/tests/basic/timeout_variation_7.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -2,6 +2,9 @@
 Timeout within for loop
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows' && version_compare(PHP_VERSION, '8.4', '<')) {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
 ?>
 --FILE--
diff -Nru php8.4-8.4.10/tests/func/005a.phpt php8.4-8.4.11/tests/func/005a.phpt
--- php8.4-8.4.10/tests/func/005a.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/tests/func/005a.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -2,6 +2,9 @@
 Testing register_shutdown_function() with timeout. (Bug: #21513)
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows' && version_compare(PHP_VERSION, '8.4', '<')) {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
 ?>
 --FILE--
diff -Nru php8.4-8.4.10/tests/lang/bug45392.phpt php8.4-8.4.11/tests/lang/bug45392.phpt
--- php8.4-8.4.10/tests/lang/bug45392.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/tests/lang/bug45392.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -2,6 +2,9 @@
 Bug #45392 (ob_start()/ob_end_clean() and memory_limit)
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows' && version_compare(PHP_VERSION, '8.4', '<')) {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 if (getenv("USE_ZEND_ALLOC") === "0") {
     die("skip Zend MM disabled");
 }
diff -Nru php8.4-8.4.10/Zend/Optimizer/zend_func_infos.h php8.4-8.4.11/Zend/Optimizer/zend_func_infos.h
--- php8.4-8.4.10/Zend/Optimizer/zend_func_infos.h	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/Optimizer/zend_func_infos.h	2025-07-29 17:30:21.000000000 +0200
@@ -393,8 +393,6 @@
 	F1("compact", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	FN("array_fill", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_ANY),
 	F1("array_fill_keys", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
-	F1("array_replace", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
-	F1("array_replace_recursive", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	FN("array_keys", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_LONG|MAY_BE_ARRAY_OF_STRING),
 	FN("array_values", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	F1("array_count_values", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_LONG),
@@ -403,13 +401,8 @@
 	F1("array_flip", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_LONG|MAY_BE_ARRAY_OF_STRING),
 	F1("array_change_key_case", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	F1("array_intersect_key", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
-	F1("array_intersect_ukey", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
-	F1("array_intersect", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
-	F1("array_uintersect", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	F1("array_intersect_assoc", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	F1("array_uintersect_assoc", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
-	F1("array_intersect_uassoc", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
-	F1("array_uintersect_uassoc", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	F1("array_diff_key", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	F1("array_diff_ukey", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
 	F1("array_udiff", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF),
diff -Nru php8.4-8.4.10/Zend/tests/bug40770.phpt php8.4-8.4.11/Zend/tests/bug40770.phpt
--- php8.4-8.4.10/Zend/tests/bug40770.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/tests/bug40770.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -4,6 +4,9 @@
 memory_limit=8M
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows' && version_compare(PHP_VERSION, '8.4', '<')) {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 $zend_mm_enabled = getenv("USE_ZEND_ALLOC");
 if ($zend_mm_enabled === "0") {
     die("skip Zend MM disabled");
diff -Nru php8.4-8.4.10/Zend/tests/bug70258.phpt php8.4-8.4.11/Zend/tests/bug70258.phpt
--- php8.4-8.4.10/Zend/tests/bug70258.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/tests/bug70258.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -4,6 +4,9 @@
 memory_limit=2M
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows') {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 $zend_mm_enabled = getenv("USE_ZEND_ALLOC");
 if ($zend_mm_enabled === "0") {
     die("skip Zend MM disabled");
diff -Nru php8.4-8.4.10/Zend/tests/gh11189_1.phpt php8.4-8.4.11/Zend/tests/gh11189_1.phpt
--- php8.4-8.4.10/Zend/tests/gh11189_1.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/tests/gh11189_1.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -2,6 +2,9 @@
 GH-11189: Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state (not packed array)
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows') {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 if (getenv("USE_ZEND_ALLOC") === "0") die("skip ZMM is disabled");
 ?>
 --INI--
diff -Nru php8.4-8.4.10/Zend/tests/gh11189.phpt php8.4-8.4.11/Zend/tests/gh11189.phpt
--- php8.4-8.4.10/Zend/tests/gh11189.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/tests/gh11189.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -2,6 +2,9 @@
 GH-11189: Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state (packed array)
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows') {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 if (getenv("USE_ZEND_ALLOC") === "0") die("skip ZMM is disabled");
 ?>
 --INI--
diff -Nru php8.4-8.4.10/Zend/tests/gh12073.phpt php8.4-8.4.11/Zend/tests/gh12073.phpt
--- php8.4-8.4.10/Zend/tests/gh12073.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/tests/gh12073.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -2,6 +2,9 @@
 GH-12073: Freeing of non-ZMM pointer of incompletely allocated closure
 --SKIPIF--
 <?php
+if (PHP_OS_FAMILY === 'Windows' && version_compare(PHP_VERSION, '8.4', '<')) {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
 if (getenv("USE_ZEND_ALLOC") === "0" && getenv("USE_TRACKED_ALLOC") !== "1") {
     die("skip Zend MM disabled");
 }
diff -Nru php8.4-8.4.10/Zend/tests/gh18833.phpt php8.4-8.4.11/Zend/tests/gh18833.phpt
--- php8.4-8.4.10/Zend/tests/gh18833.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/Zend/tests/gh18833.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,24 @@
+--TEST--
+GH-18833 (Use after free with weakmaps dependent on destruction order)
+--FILE--
+<?php
+
+class a {
+    public static WeakMap $map;
+    public static Generator $storage;
+}
+
+a::$map = new WeakMap;
+
+$closure = function () {
+    $obj = new a;
+    a::$map[$obj] = true;
+    yield $obj;
+};
+a::$storage = $closure();
+a::$storage->current();
+
+echo "ok\n";
+?>
+--EXPECT--
+ok
diff -Nru php8.4-8.4.10/Zend/tests/gh18907.phpt php8.4-8.4.11/Zend/tests/gh18907.phpt
--- php8.4-8.4.10/Zend/tests/gh18907.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/Zend/tests/gh18907.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,26 @@
+--TEST--
+GH-18907: Leak when creating cycle inside hook
+--FILE--
+<?php
+
+class Foo {
+    public $prop {
+        get {
+            $this->prop = $this;
+            return 1;
+        }
+    }
+}
+
+function test() {
+    var_dump((new Foo)->prop);
+}
+
+/* Call twice to test the ZEND_IS_PROPERTY_HOOK_SIMPLE_GET() path. */
+test();
+test();
+
+?>
+--EXPECT--
+int(1)
+int(1)
diff -Nru php8.4-8.4.10/Zend/tests/numeric_strings/oss_fuzz_427814456.phpt php8.4-8.4.11/Zend/tests/numeric_strings/oss_fuzz_427814456.phpt
--- php8.4-8.4.10/Zend/tests/numeric_strings/oss_fuzz_427814456.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/Zend/tests/numeric_strings/oss_fuzz_427814456.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,11 @@
+--TEST--
+OSS-Fuzz #427814456
+--FILE--
+<?php
+set_error_handler(function(){unset($GLOBALS['x']);});
+$x = str_repeat("3e33", random_int(2, 2));
+$x & true;
+echo "Done\n";
+?>
+--EXPECT--
+Done
diff -Nru php8.4-8.4.10/Zend/tests/traits/bugs/gh13177.phpt php8.4-8.4.11/Zend/tests/traits/bugs/gh13177.phpt
--- php8.4-8.4.10/Zend/tests/traits/bugs/gh13177.phpt	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/tests/traits/bugs/gh13177.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -1,5 +1,11 @@
 --TEST--
 GH-13177 (PHP 8.3.2: final private constructor not allowed when used in trait)
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY === 'Windows' && version_compare(PHP_VERSION, '8.4', '<')) {
+    die("xfail fails on Windows Server 2022 and newer.");
+}
+?>
 --FILE--
 <?php
 
diff -Nru php8.4-8.4.10/Zend/tests/zend_ini/oss_fuzz_428983568.phpt php8.4-8.4.11/Zend/tests/zend_ini/oss_fuzz_428983568.phpt
--- php8.4-8.4.10/Zend/tests/zend_ini/oss_fuzz_428983568.phpt	1970-01-01 01:00:00.000000000 +0100
+++ php8.4-8.4.11/Zend/tests/zend_ini/oss_fuzz_428983568.phpt	2025-07-29 17:30:21.000000000 +0200
@@ -0,0 +1,14 @@
+--TEST--
+OSS-Fuzz #428983568
+--FILE--
+<?php
+$ini = <<<INI
+[\${zz:-x
+
+INI;
+var_dump(parse_ini_string($ini));
+?>
+--EXPECTF--
+Warning: syntax error, unexpected end of file, expecting '}' in Unknown on line 1
+ in %s on line %d
+bool(false)
diff -Nru php8.4-8.4.10/Zend/zend_alloc.c php8.4-8.4.11/Zend/zend_alloc.c
--- php8.4-8.4.10/Zend/zend_alloc.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_alloc.c	2025-07-29 17:30:21.000000000 +0200
@@ -2411,6 +2411,7 @@
 			}
 #if ZEND_MM_STAT
 			heap->size = 0;
+			heap->real_size = 0;
 #endif
 		}
 
@@ -2977,6 +2978,7 @@
 	tracked_add(heap, ptr, size);
 #if ZEND_MM_STAT
 	heap->size += size;
+	heap->real_size = heap->size;
 #endif
 	return ptr;
 }
@@ -2990,6 +2992,7 @@
 	zval *size_zv = tracked_get_size_zv(heap, ptr);
 #if ZEND_MM_STAT
 	heap->size -= Z_LVAL_P(size_zv);
+	heap->real_size = heap->size;
 #endif
 	zend_hash_del_bucket(heap->tracked_allocs, (Bucket *) size_zv);
 	free(ptr);
@@ -3017,6 +3020,7 @@
 	tracked_add(heap, ptr, new_size);
 #if ZEND_MM_STAT
 	heap->size += new_size - old_size;
+	heap->real_size = heap->size;
 #endif
 	return ptr;
 }
diff -Nru php8.4-8.4.10/Zend/zend.h php8.4-8.4.11/Zend/zend.h
--- php8.4-8.4.10/Zend/zend.h	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend.h	2025-07-29 17:30:21.000000000 +0200
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "4.4.10"
+#define ZEND_VERSION "4.4.11"
 
 #define ZEND_ENGINE_3
 
diff -Nru php8.4-8.4.10/Zend/zend_ini_parser.c php8.4-8.4.11/Zend/zend_ini_parser.c
--- php8.4-8.4.10/Zend/zend_ini_parser.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_ini_parser.c	2025-07-29 17:30:21.000000000 +0200
@@ -1586,6 +1586,10 @@
             { zval_ini_dtor(&(*yyvaluep)); }
         break;
 
+    case YYSYMBOL_fallback: /* fallback  */
+            { zval_ini_dtor(&(*yyvaluep)); }
+        break;
+
     case YYSYMBOL_constant_literal: /* constant_literal  */
             { zval_ini_dtor(&(*yyvaluep)); }
         break;
diff -Nru php8.4-8.4.10/Zend/zend_ini_parser.y php8.4-8.4.11/Zend/zend_ini_parser.y
--- php8.4-8.4.10/Zend/zend_ini_parser.y	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_ini_parser.y	2025-07-29 17:30:21.000000000 +0200
@@ -353,7 +353,7 @@
 %left '|' '&' '^'
 %precedence '~' '!'
 
-%destructor { zval_ini_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL cfg_var_ref constant_literal constant_string encapsed_list expr option_offset section_string_or_value string_or_value var_string_list var_string_list_section
+%destructor { zval_ini_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL cfg_var_ref constant_literal constant_string encapsed_list expr fallback option_offset section_string_or_value string_or_value var_string_list var_string_list_section
 
 %%
 
diff -Nru php8.4-8.4.10/Zend/zend_ini_scanner.l php8.4-8.4.11/Zend/zend_ini_scanner.l
--- php8.4-8.4.10/Zend/zend_ini_scanner.l	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_ini_scanner.l	2025-07-29 17:30:21.000000000 +0200
@@ -352,16 +352,16 @@
 /*!re2c
 re2c:yyfill:check = 0;
 LNUM [0-9]+
-DNUM ([0-9]*[\.][0-9]+)|([0-9]+[\.][0-9]*)
+DNUM ([0-9]*[.][0-9]+)|([0-9]+[.][0-9]*)
 NUMBER [-]?{LNUM}|{DNUM}
 ANY_CHAR (.|[\n\t])
 NEWLINE	("\r"|"\n"|"\r\n")
 TABS_AND_SPACES [ \t]
 WHITESPACE [ \t]+
 CONSTANT [a-zA-Z_][a-zA-Z0-9_]*
-LABEL_CHAR [^=\n\r\t;&|^$~(){}!"\[\]\x00]
+LABEL_CHAR [^=\n\r\t;&|^$~(){}!"[\]\x00]
 LABEL ({LABEL_CHAR}+)
-TOKENS [:,.\[\]"'()&|^+-/*=%$!~<>?@{}]
+TOKENS [:,.[\]"'()&|^+-/*=%$!~<>?@{}]
 OPERATORS [&|^~()!]
 DOLLAR_CURLY "${"
 
diff -Nru php8.4-8.4.10/Zend/zend_language_scanner.l php8.4-8.4.11/Zend/zend_language_scanner.l
--- php8.4-8.4.10/Zend/zend_language_scanner.l	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_language_scanner.l	2025-07-29 17:30:21.000000000 +0200
@@ -1813,11 +1813,11 @@
 	RETURN_TOKEN(T_MUL_EQUAL);
 }
 
-<ST_IN_SCRIPTING>"*\*" {
+<ST_IN_SCRIPTING>"**" {
 	RETURN_TOKEN(T_POW);
 }
 
-<ST_IN_SCRIPTING>"*\*=" {
+<ST_IN_SCRIPTING>"**=" {
 	RETURN_TOKEN(T_POW_EQUAL);
 }
 
diff -Nru php8.4-8.4.10/Zend/zend_object_handlers.c php8.4-8.4.11/Zend/zend_object_handlers.c
--- php8.4-8.4.10/Zend/zend_object_handlers.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_object_handlers.c	2025-07-29 17:30:21.000000000 +0200
@@ -719,7 +719,9 @@
 		return false;
 	}
 
+	GC_ADDREF(zobj);
 	zend_call_known_instance_method_with_0_params(get, zobj, rv);
+	OBJ_RELEASE(zobj);
 
 	return true;
 }
diff -Nru php8.4-8.4.10/Zend/zend_objects_API.c php8.4-8.4.11/Zend/zend_objects_API.c
--- php8.4-8.4.10/Zend/zend_objects_API.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_objects_API.c	2025-07-29 17:30:21.000000000 +0200
@@ -100,7 +100,9 @@
 			if (IS_OBJ_VALID(obj)) {
 				if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
 					GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
-					if (obj->handlers->free_obj != zend_object_std_dtor) {
+					if (obj->handlers->free_obj != zend_object_std_dtor
+					 || (OBJ_FLAGS(obj) & IS_OBJ_WEAKLY_REFERENCED)
+					) {
 						GC_ADDREF(obj);
 						obj->handlers->free_obj(obj);
 					}
diff -Nru php8.4-8.4.10/Zend/zend_operators.c php8.4-8.4.11/Zend/zend_operators.c
--- php8.4-8.4.10/Zend/zend_operators.c	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_operators.c	2025-07-29 17:30:21.000000000 +0200
@@ -402,6 +402,7 @@
 				zend_long lval;
 				double dval;
 				bool trailing_data = false;
+				zend_string *op_str = NULL; /* protect against error handlers */
 
 				/* For BC reasons we allow errors so that we can warn on leading numeric string */
 				type = is_numeric_string_ex(Z_STRVAL_P(op), Z_STRLEN_P(op), &lval, &dval,
@@ -411,6 +412,9 @@
 					return 0;
 				}
 				if (UNEXPECTED(trailing_data)) {
+					if (type != IS_LONG) {
+						op_str = zend_string_copy(Z_STR_P(op));
+					}
 					zend_error(E_WARNING, "A non-numeric value encountered");
 					if (UNEXPECTED(EG(exception))) {
 						*failed = 1;
@@ -426,11 +430,12 @@
 					 */
 					lval = zend_dval_to_lval_cap(dval);
 					if (!zend_is_long_compatible(dval, lval)) {
-						zend_incompatible_string_to_long_error(Z_STR_P(op));
+						zend_incompatible_string_to_long_error(op_str ? op_str : Z_STR_P(op));
 						if (UNEXPECTED(EG(exception))) {
 							*failed = 1;
 						}
 					}
+					zend_tmp_string_release(op_str);
 					return lval;
 				}
 			}
diff -Nru php8.4-8.4.10/Zend/zend_vm_execute.h php8.4-8.4.11/Zend/zend_vm_execute.h
--- php8.4-8.4.10/Zend/zend_vm_execute.h	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_vm_execute.h	2025-07-29 17:30:21.000000000 +0200
@@ -55088,7 +55088,7 @@
 # pragma GCC optimize("no-gcse")
 # pragma GCC optimize("no-ivopts")
 #endif
-#ifdef _WIN64
+#if defined(_WIN64) && defined(_M_X64)
 /* See save_xmm_x86_64_ms_masm.asm */
 void execute_ex_real(zend_execute_data *ex)
 #else
diff -Nru php8.4-8.4.10/Zend/zend_vm_execute.skl php8.4-8.4.11/Zend/zend_vm_execute.skl
--- php8.4-8.4.10/Zend/zend_vm_execute.skl	2025-07-02 04:22:42.000000000 +0200
+++ php8.4-8.4.11/Zend/zend_vm_execute.skl	2025-07-29 17:30:21.000000000 +0200
@@ -5,7 +5,7 @@
 # pragma GCC optimize("no-gcse")
 # pragma GCC optimize("no-ivopts")
 #endif
-#ifdef _WIN64
+#if defined(_WIN64) && defined(_M_X64)
 /* See save_xmm_x86_64_ms_masm.asm */
 void {%EXECUTOR_NAME%}_ex_real(zend_execute_data *ex)
 #else
