CVE-2026-7258: fix signed-char passing to ctype.h functions in urldecode
and url parsing (GHSA-m8rr-4c36-8gq4)
CVE-2026-7262: fix NULL check in tozvalmap() using wrong variable xmlKey
instead of xmlValue, causing crash in SOAP typemap decoding (GHSA-hmxp-6pc4-f3vv)
CVE-2026-7568: fix signed integer overflow in metaphone() by switching
widx/idx/howfar from int to size_t in ext/standard/metaphone.c