@@ -50,6 +50,10 @@ PHP                                                                        NEWS
   . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
     file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)
 
+- Zip:
+  . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
+    configuration. (Weilin Du)
+
 
 30 Jul 2026, PHP 8.2.33