- update 7.3.33
  . http://www.php.net/ChangeLog-7.php#7.3.33
  . http://www.php.net/ChangeLog-7.php#7.3.32
  . http://www.php.net/ChangeLog-7.php#7.3.31
  . http://www.php.net/ChangeLog-7.php#7.3.30
  . http://www.php.net/ChangeLog-7.php#7.3.29
  . http://www.php.net/ChangeLog-7.php#7.3.28

- security issues
  . CVE-2021-21705 Core: SSRF bypass in FILTER_VALIDATE_URL. (#81122)
  . CVE-2021-21706 Zip: ZipArchive::extractTo extracts outside of destination (#81420)
  . CVE-2021-21703 FPM: PHP-FPM oob R/W in root process leading to privilege escalation (#81026)
  . CVE-2021-21707 XML: Fix #79971: special character is breaking the path in xml function (#79971)
  . #79812 Pcntl: Potential integer overflow in pcntl_exec()

- update 7.3.27
  . http://www.php.net/ChangeLog-7.php#7.3.26
  . http://www.php.net/ChangeLog-7.php#7.3.27

- security issues
  . CVE-2020-7071 Standard: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (#77423)
  . CVE-2021-21702 Soap: Null Dereference in SoapClient

- update 7.3.25
  . http://www.php.net/ChangeLog-7.php#7.3.19
  . http://www.php.net/ChangeLog-7.php#7.3.20
  . http://www.php.net/ChangeLog-7.php#7.3.21
  . http://www.php.net/ChangeLog-7.php#7.3.22
  . http://www.php.net/ChangeLog-7.php#7.3.23
  . http://www.php.net/ChangeLog-7.php#7.3.24
  . http://www.php.net/ChangeLog-7.php#7.3.25

- official fixed
  . fixed #80457 stream_get_contents() fails with maxlength=-1 or default

- security issues
  . CVE-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (#79699)
  . CVE-2020-7069 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (#79601)
  . CVE-2020-7068 Use of freed hash key in the phar_parse_zipfile function (#79797)

- update 7.3.18
  . http://www.php.net/ChangeLog-7.php#7.3.15
  . http://www.php.net/ChangeLog-7.php#7.3.16
  . http://www.php.net/ChangeLog-7.php#7.3.17
  . http://www.php.net/ChangeLog-7.php#7.3.18

- official fixed
  . fixed #79489 Core: .user.ini does not inherit
  . fixed #79615 GD: Wrong GIF header written in GD GIFEncode
  . fixed #79596 Mysqlnd: MySQL FLOAT truncates to int some locales
  . fixed #79588 Opcache: Boolean opcache settings ignore on/off values
  . fixed #79535 Opcache: PHP crashes with specific opcache.optimization_level
  . fixed #79561 Standard: dns_get_record() fails with DNS_ALL

- security issues
  . CVE-2019-11048 Core: Long filenames cause OOM and temp files are not cleaned
  . CVE-2019-11048 Core: Long variables in multipart/form-data cause OOM and temp files are not cleaned
  . CVE-2020-7064 Exif: Use-of-uninitialized-value in exif
  . CVE-2020-7065 MBstring: mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full
  . CVE-2020-7067 Standard: OOB Read in urldecode()
  . CVE-2020-7066 Standard: get_headers() silently truncates after a null byte
  . CVE-2020-7063 Phar: Files added to tar with Phar::buildFromIterator have all-access permissions
  . CVE-2020-7061 Phar: heap-buffer-overflow in phar_extract_file
  . CVE-2020-7062 Session: Null Pointer Dereference in PHP Session Upload Progress

- update 7.3.14
  . http://www.php.net/ChangeLog-7.php#7.3.7
  . http://www.php.net/ChangeLog-7.php#7.3.8
  . http://www.php.net/ChangeLog-7.php#7.3.9
  . http://www.php.net/ChangeLog-7.php#7.3.10
  . http://www.php.net/ChangeLog-7.php#7.3.11
  . http://www.php.net/ChangeLog-7.php#7.3.12
  . http://www.php.net/ChangeLog-7.php#7.3.13
  . http://www.php.net/ChangeLog-7.php#7.3.14

- official fixed
  . fixed #71876 Core: Memory corruption htmlspecialchars(): charset `*' not supported
  . fixed #79146 Core: cscript can fail to run on some systems
  . fixed #79078 CURL: Hypothetical use-after-free in curl_multi_add_handle()
  . fixed #79154 MBString: mb_convert_encoding() can modify $from_encoding
  . fixed #79084 MySQLnd: mysqlnd may fetch wrong column indexes with MYSQLI_BOTH
  . fixed #79145 OpenSSL: openssl memory leak
  . fixed #79115 Reflection: ReflectionClass::isCloneable call reflected class __destruct

- security issues
  . CVE-2020-7059 Standard: OOB read in php_strip_tags_ex
  . CVE-2020-7060 Mbstring: global buffer-overflow in 'mbfl_filt_conv_big5_wchar'
  . CVE-2019-11041 EXIF: heap-buffer-overflow on exif_scan_thumbnail
  . CVE-2019-11042 EXIF: heap-buffer-overflow on exif_process_user_comment
  . CVE-2019-11043 FPM: env_path_info underflow in fpm_main.c can lead to RCE
  . CVE-2019-11044 Core: link() silently truncates after a null byte on Windows
  . CVE-2019-11045 Core: DirectoryIterator class silently truncates after a null byte
  . CVE-2019-11046 Bcmath: Buffer underflow in bc_shift_addsub
  . CVE-2019-11047 EXIF: Heap-buffer-overflow READ in exif
  . CVE-2019-11049 Core: mail() may release string with refcount==1 twice
  . CVE-2019-11050 EXIF: Use-after-free in exif parsing under memory sanitizer
  . CVE-2019-13224 MBString: Oniguruma 6.9.3 fixes CVEs