Tim Düsterhus

Cross-origin credential leak in HTTP stream wrapper redirects

password_verify() always returns true for some invalid hashes

Signed integer overflow in metaphone()

libxml streams use wrong content-type header when requesting a redirected resource

Header parser of http stream wrapper does not handle folded headers

Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP