package/php: security bump to v8.3.31

See the release notes: https://www.php.net/ChangeLog-8.php#8.3.31

- CVE-2025-14179:
    In PHP versions, the PDO Firebird driver improperly handles NUL
    bytes when preparing SQL queries. During token-by-token query
    construction, a string token containing a NUL byte is copied via
    strncat(), which stops at the NUL byte, dropping the closing quote
    and causing subsequent SQL tokens to be interpreted as part of the
    string.
    This allows SQL injection when attacker-controlled values are quoted
    via PDO::quote() and embedded in SQL statements.

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
  - https://www.cve.org/CVERecord?id=CVE-2025-14179

- CVE-2026-6722:
    In PHP versions, the SOAP extension's object deduplication mechanism
    stores pointers to PHP objects in a global map without incrementing
    their reference counts. When an apache:Map node contains duplicate
    keys, processing the second entry overwrites the first in the
    temporary result map, freeing the original PHP object while its
    stale pointer remains in the map. A subsequent href reference to the
    freed node can copy the dangling pointer into the result. As PHP
    string allocations can reclaim the freed memory region, an attacker
    with control over the SOAP request body can exploit this
    use-after-free to achieve remote code execution.

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
  - https://www.cve.org/CVERecord?id=CVE-2026-6722

- CVE-2026-6735:
    In PHP, due to improper sanitation of user data, it allows an
    attacker to compose an URL, which will cause the target to execute
    arbitrary JavaScript code (XSS) on the target's machine when the
    target is viewing the PHP-FPM status page.

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv
  - https://www.cve.org/CVERecord?id=CVE-2026-6735

- CVE-2026-7258:
    In PHP, some functions, including urldecode(), pass signed char to
    ctype functions (like isxdigit()). On the systems with default
    signed char and optimized table-lookup ctype functions - such as
    NetBSD - this can lead to accessing array with negative offset,
    which can trigger a denial of service.

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4
  - https://www.cve.org/CVERecord?id=CVE-2026-7258

- CVE-2026-7259:
    In PHP, a mismatch between encoding lists in Oniguruma and mbfl
    leads to  a NULL pointer dereference, resulting in a segmentation
    fault and denial of service. The vulnerability is exploitable when
    user-controlled input can influence the encoding passed
    to mb_regex_encoding().

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75
  - https://www.cve.org/CVERecord?id=CVE-2026-7259

- CVE-2026-7261:
    In PHP, when SoapServer is configured with SOAP_PERSISTENCE_SESSION,
    the handler object is persisted across requests via session storage.
    However, in the case SOAP requests results in an error, the
    persistance is handled incorrectly, resulting in freeing the object
    while keeping a pointer to it, which may lead to use-after-free.
    This may lead to memory corruption, information disclosure, or
    process crashes, with confidentiality, integrity, and availability
    impact on the vulnerable system.

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q
  - https://www.cve.org/CVERecord?id=CVE-2026-7261

- CVE-2026-7262:
    In PHP, when a SOAP server has a typemap configured, the decoding
    process contains a mistake which checks the wrong variable in case
    of missing value element.  This leads to dereferences a NULL
    pointer, causing a segmentation fault. This allows a remote
    unauthenticated attacker to crash the PHP SOAP server process,
    resulting in denial of service.

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv
  - https://www.cve.org/CVERecord?id=CVE-2026-7262

- CVE-2026-7568:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before
    8.4.21, and 8.5.* before 8.5.6, the metaphone() function in
    ext/standard/metaphone.c uses a signed int variable to track the
    current position within the input string. If a string longer than
    2,147,483,647 bytes is passed, a signed integer overflow occurs,
    resulting in undefined behavior. This can lead to an out-of-bounds
    read, causing a segmentation fault or access to unrelated memory, and
    may affect the availability of the PHP process.

For more information, see:
  - https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57
  - https://www.cve.org/CVERecord?id=CVE-2026-7568

(cherry picked from 952aa90078)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

package/php/php.hash

@@ -1,5 +1,5 @@
 # From https://www.php.net/downloads.php
-sha256  67f084d36852daab6809561a7c8023d130ca07fc6af8fb040684dd1414934d48  php-8.3.30.tar.xz
+sha256  66410cee07f4b2baeb0843140bb2a2b52ef930b5cf9b3d6e6d158b33aae8fa37  php-8.3.31.tar.xz
 
 # License file
 sha256  b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a  LICENSE

package/php/php.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-PHP_VERSION = 8.3.30
+PHP_VERSION = 8.3.31
 PHP_SITE = https://www.php.net/distributions
 PHP_SOURCE = php-$(PHP_VERSION).tar.xz
 PHP_INSTALL_STAGING = YES