Commit ac1a9c18137 for php

commit ac1a9c18137864a17963a6ada6a437e31ffbb3bf
Merge: 33d7f34694f 2f7951d6490
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Fri Oct 9 07:08:00 2026 -0400

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      ext/standard: Validate the bcrypt cost before reading it

diff --cc NEWS
index 19f11fd33db,64d75dfc03a..8561f853ec9
--- a/NEWS
+++ b/NEWS
@@@ -19,6 -25,16 +19,10 @@@ PH
    . Fix too wide type inference for ASSIGN_DIM_OP. (ndossche)
    . Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)

 -- SOAP:
 -  . Fixed use of uninitialized func in do_request() on OOM bailout.
 -    (David Carlier)
 -
+ - Standard:
 -  . Fixed chown() and lchown() failing to resolve user names in ZTS builds
 -    when getpwnam_r() needs a larger buffer. (Ilia Alshanetsky)
+   . Fixed password_get_info() and password_needs_rehash() accepting malformed
+     bcrypt costs. (Ilia Alshanetsky)
+
  - Zip:
    . Fixed use-after-free when re-entering ZipArchive during destruction or
      a close warning, and rejected opening streams while closing. (jvoisin)