Add NEWS entries

iluuu1994 · iluuu1994 · commit 9e7ffc2b38cb · 2026-07-28T11:34:37.000+02:00
diff --git a/NEWS b/NEWS
@@ -5,6 +5,17 @@ PHP                                                                        NEWS
 - Date:
   . Fixed leak on double DatePeriod::__construct() call. (ilutov)
 
+- GD:
+  . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
+
+- PGSQL:
+  . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
+    (CVE-2026-17543) (ilutov)
+
+- Phar:
+  . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
+    (Jakub Zelenka)
+
 02 Jul 2026, PHP 8.3.32
 
 - Streams:
