NEWS

(cherry picked from commit 293cd3b)

Author: remicollet

NEWS

@@ -8,6 +8,8 @@ Backported from 8.1.28
     partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
   . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
     opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)
+  . Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command
+    parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
 
 Backported from 8.0.30