add missing CVEs

Author: remicollet

NEWS

@@ -15,6 +15,8 @@ PHP                                                                        NEWS
     Christian Schneider)
   . Fixed bug GH-9407 (LSP error in eval'd code refers to wrong class for static
     type). (ilutov)
+  . Fixed bug #81727: Don't mangle HTTP variable names that clash with ones
+    that have a specific semantic meaning. (CVE-2022-31629). (Derick)
 
 - DOM:
   . Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).
@@ -38,6 +40,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).
     (Yurunsoft)
 
+- Phar:
+  . Fixed bug #81726: phar wrapper: DOS when using quine gzip file.
+    (CVE-2022-31628). (cmb)
+
 - Reflection:
   . Fixed bug GH-8932 (ReflectionFunction provides no way to get the called
     class of a Closure). (cmb, Nicolas Grekas)