A PHP 7.2.27 security update and security backports for PHP 5.6, 7.0, and 7.1 are now available.

23 Jan 2020, PHP 7.2.27

- Mbstring:
. Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060) (Nikita)

- Session:
. Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita)

- Standard:
. Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)