Version in base suite: 6.8.3+dfsg1-0+deb13u1

Base version: wordpress_6.8.3+dfsg1-0+deb13u1
Target version: wordpress_6.8.6+dfsg1-0+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/w/wordpress/wordpress_6.8.3+dfsg1-0+deb13u1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/w/wordpress/wordpress_6.8.6+dfsg1-0+deb13u1.dsc

 debian/changelog                                             |    9 
 wp-admin/about.php                                           |   40 +++
 wp-admin/includes/class-walker-nav-menu-checklist.php        |    8 
 wp-admin/includes/class-walker-nav-menu-edit.php             |   12 -
 wp-admin/includes/file.php                                   |    5 
 wp-includes/ID3/getid3.lib.php                               |    4 
 wp-includes/certificates/ca-bundle.crt                       |  125 ++++++++++-
 wp-includes/class-wp-block-patterns-registry.php             |   13 +
 wp-includes/class-wp-http-ixr-client.php                     |    2 
 wp-includes/class-wp-query.php                               |   14 -
 wp-includes/html-api/class-wp-html-tag-processor.php         |    9 
 wp-includes/interactivity-api/class-wp-interactivity-api.php |   14 +
 wp-includes/js/wp-util.js                                    |    5 
 wp-includes/js/wp-util.min.js                                |    2 
 wp-includes/kses.php                                         |    4 
 wp-includes/media.php                                        |    2 
 wp-includes/nav-menu.php                                     |    2 
 wp-includes/rest-api.php                                     |    9 
 wp-includes/rest-api/class-wp-rest-server.php                |   13 +
 wp-includes/template-loader.php                              |   11 
 wp-includes/version.php                                      |    2 
 21 files changed, 274 insertions(+), 31 deletions(-)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpk7nnx_7a/wordpress_6.8.3+dfsg1-0+deb13u1.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpk7nnx_7a/wordpress_6.8.6+dfsg1-0+deb13u1.dsc: no acceptable signature found
diff -Nru wordpress-6.8.3+dfsg1/debian/changelog wordpress-6.8.6+dfsg1/debian/changelog
--- wordpress-6.8.3+dfsg1/debian/changelog	2025-12-17 18:35:24.000000000 +0000
+++ wordpress-6.8.6+dfsg1/debian/changelog	2026-07-21 06:46:23.000000000 +0000
@@ -1,3 +1,12 @@
+wordpress (6.8.6+dfsg1-0+deb13u1) trixie-security; urgency=medium
+
+  * New upstream security release 6.8.6
+  * CVE-2026-60137 fix facilitated SQL injection Closes: #1142510
+  * Includes release 6.8.4 and 6.8.5 updates
+    - Check permissions on edit notes CVE-2026-3906 (not vulnerable)
+
+ -- Craig Small <csmall@debian.org>  Tue, 21 Jul 2026 16:46:23 +1000
+
 wordpress (6.8.3+dfsg1-0+deb13u1) trixie-security; urgency=high
 
   * Non-maintainer upload.
diff -Nru wordpress-6.8.3+dfsg1/wp-admin/about.php wordpress-6.8.6+dfsg1/wp-admin/about.php
--- wordpress-6.8.3+dfsg1/wp-admin/about.php	2025-09-30 17:30:38.000000000 +0000
+++ wordpress-6.8.6+dfsg1/wp-admin/about.php	2026-07-17 17:55:58.000000000 +0000
@@ -62,6 +62,46 @@
 					printf(
 						/* translators: %s: WordPress version. */
 						__( '<strong>Version %s</strong> addressed some security issues.' ),
+						'6.8.6'
+					);
+					?>
+					<?php
+					printf(
+						/* translators: %s: HelpHub URL. */
+						__( 'For more information, see <a href="%s">the release notes</a>.' ),
+						sprintf(
+							/* translators: %s: WordPress version. */
+							esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+							sanitize_title( '6.8.6' )
+						)
+					);
+					?>
+				</p>
+				<p>
+					<?php
+					printf(
+						/* translators: %s: WordPress version. */
+						__( '<strong>Version %s</strong> addressed some security issues.' ),
+						'6.8.5'
+					);
+					?>
+					<?php
+					printf(
+						/* translators: %s: HelpHub URL. */
+						__( 'For more information, see <a href="%s">the release notes</a>.' ),
+						sprintf(
+							/* translators: %s: WordPress version. */
+							esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+							sanitize_title( '6.8.5' )
+						)
+					);
+					?>
+				</p>
+				<p>
+					<?php
+					printf(
+						/* translators: %s: WordPress version. */
+						__( '<strong>Version %s</strong> addressed some security issues.' ),
 						'6.8.3'
 					);
 					?>
diff -Nru wordpress-6.8.3+dfsg1/wp-admin/includes/class-walker-nav-menu-checklist.php wordpress-6.8.6+dfsg1/wp-admin/includes/class-walker-nav-menu-checklist.php
--- wordpress-6.8.3+dfsg1/wp-admin/includes/class-walker-nav-menu-checklist.php	2023-09-08 09:32:23.876231000 +0000
+++ wordpress-6.8.6+dfsg1/wp-admin/includes/class-walker-nav-menu-checklist.php	2026-03-10 16:37:37.009287000 +0000
@@ -116,11 +116,11 @@
 		$output .= '<input type="hidden" class="menu-item-object" name="menu-item[' . $possible_object_id . '][menu-item-object]" value="' . esc_attr( $menu_item->object ) . '" />';
 		$output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="' . esc_attr( $menu_item->menu_item_parent ) . '" />';
 		$output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $menu_item->type ) . '" />';
-		$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . esc_attr( $menu_item->title ) . '" />';
+		$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . htmlspecialchars( $menu_item->title, ENT_QUOTES ) . '" />';
 		$output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="' . esc_attr( $menu_item->url ) . '" />';
 		$output .= '<input type="hidden" class="menu-item-target" name="menu-item[' . $possible_object_id . '][menu-item-target]" value="' . esc_attr( $menu_item->target ) . '" />';
-		$output .= '<input type="hidden" class="menu-item-attr-title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . esc_attr( $menu_item->attr_title ) . '" />';
-		$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . esc_attr( implode( ' ', $menu_item->classes ) ) . '" />';
-		$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . esc_attr( $menu_item->xfn ) . '" />';
+		$output .= '<input type="hidden" class="menu-item-attr-title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . htmlspecialchars( $menu_item->attr_title, ENT_QUOTES ) . '" />';
+		$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . htmlspecialchars( implode( ' ', $menu_item->classes ), ENT_QUOTES ) . '" />';
+		$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . htmlspecialchars( $menu_item->xfn, ENT_QUOTES ) . '" />';
 	}
 }
diff -Nru wordpress-6.8.3+dfsg1/wp-admin/includes/class-walker-nav-menu-edit.php wordpress-6.8.6+dfsg1/wp-admin/includes/class-walker-nav-menu-edit.php
--- wordpress-6.8.3+dfsg1/wp-admin/includes/class-walker-nav-menu-edit.php	2024-10-21 19:55:16.399798000 +0000
+++ wordpress-6.8.6+dfsg1/wp-admin/includes/class-walker-nav-menu-edit.php	2026-03-10 16:37:37.009287000 +0000
@@ -203,13 +203,13 @@
 				<p class="description description-wide">
 					<label for="edit-menu-item-title-<?php echo $item_id; ?>">
 						<?php _e( 'Navigation Label' ); ?><br />
-						<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->title ); ?>" />
+						<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->title, ENT_QUOTES ); ?>" />
 					</label>
 				</p>
 				<p class="field-title-attribute field-attr-title description description-wide">
 					<label for="edit-menu-item-attr-title-<?php echo $item_id; ?>">
 						<?php _e( 'Title Attribute' ); ?><br />
-						<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->post_excerpt ); ?>" />
+						<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->post_excerpt, ENT_QUOTES ); ?>" />
 					</label>
 				</p>
 				<p class="field-link-target description">
@@ -222,20 +222,20 @@
 					<p class="field-css-classes description description-thin">
 						<label for="edit-menu-item-classes-<?php echo $item_id; ?>">
 							<?php _e( 'CSS Classes (optional)' ); ?><br />
-							<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo esc_attr( implode( ' ', $menu_item->classes ) ); ?>" />
+							<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( implode( ' ', $menu_item->classes ), ENT_QUOTES ); ?>" />
 						</label>
 					</p>
 					<p class="field-xfn description description-thin">
 						<label for="edit-menu-item-xfn-<?php echo $item_id; ?>">
 							<?php _e( 'Link Relationship (XFN)' ); ?><br />
-							<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->xfn ); ?>" />
+							<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->xfn, ENT_QUOTES ); ?>" />
 						</label>
 					</p>
 				</div>
 				<p class="field-description description description-wide">
 					<label for="edit-menu-item-description-<?php echo $item_id; ?>">
 						<?php _e( 'Description' ); ?><br />
-						<textarea id="edit-menu-item-description-<?php echo $item_id; ?>" class="widefat edit-menu-item-description" rows="3" cols="20" name="menu-item-description[<?php echo $item_id; ?>]"><?php echo esc_html( $menu_item->description ); // textarea_escaped ?></textarea>
+						<textarea id="edit-menu-item-description-<?php echo $item_id; ?>" class="widefat edit-menu-item-description" rows="3" cols="20" name="menu-item-description[<?php echo $item_id; ?>]"><?php echo esc_textarea( $menu_item->description ); // textarea_escaped ?></textarea>
 						<span class="description"><?php _e( 'The description will be displayed in the menu if the active theme supports it.' ); ?></span>
 					</label>
 				</p>
@@ -347,4 +347,4 @@
 		<?php
 		$output .= ob_get_clean();
 	}
-}
\ No newline at end of file
+}
diff -Nru wordpress-6.8.3+dfsg1/wp-admin/includes/file.php wordpress-6.8.6+dfsg1/wp-admin/includes/file.php
--- wordpress-6.8.3+dfsg1/wp-admin/includes/file.php	2025-03-03 00:19:23.571346000 +0000
+++ wordpress-6.8.6+dfsg1/wp-admin/includes/file.php	2026-03-10 16:37:37.009287000 +0000
@@ -1901,6 +1901,11 @@
 			continue;
 		}
 
+		// Don't extract invalid files:
+		if ( 0 !== validate_file( $file['filename'] ) ) {
+			continue;
+		}
+
 		$uncompressed_size += $file['size'];
 
 		$needed_dirs[] = $to . untrailingslashit( $file['folder'] ? $file['filename'] : dirname( $file['filename'] ) );
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/ID3/getid3.lib.php wordpress-6.8.6+dfsg1/wp-includes/ID3/getid3.lib.php
--- wordpress-6.8.3+dfsg1/wp-includes/ID3/getid3.lib.php	2023-10-20 13:29:27.860361000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/ID3/getid3.lib.php	2026-03-10 16:37:37.009287000 +0000
@@ -13,9 +13,9 @@
 
 if(!defined('GETID3_LIBXML_OPTIONS') && defined('LIBXML_VERSION')) {
 	if(LIBXML_VERSION >= 20621) {
-		define('GETID3_LIBXML_OPTIONS', LIBXML_NOENT | LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT);
+		define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT);
 	} else {
-		define('GETID3_LIBXML_OPTIONS', LIBXML_NOENT | LIBXML_NONET | LIBXML_NOWARNING);
+		define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING);
 	}
 }
 
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/certificates/ca-bundle.crt wordpress-6.8.6+dfsg1/wp-includes/certificates/ca-bundle.crt
--- wordpress-6.8.3+dfsg1/wp-includes/certificates/ca-bundle.crt	2025-06-30 16:57:29.857119000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/certificates/ca-bundle.crt	2025-11-06 19:48:27.602767000 +0000
@@ -61,7 +61,7 @@
 ##
 ## Bundle of CA Root Certificates
 ##
-## Certificate data from Mozilla as of: Tue May 20 03:12:02 2025 GMT
+## Certificate data from Mozilla as of: Tue Nov  4 04:12:02 2025 GMT
 ##
 ## Find updated versions here: https://curl.se/docs/caextract.html
 ##
@@ -76,7 +76,7 @@
 ## Just configure this file as the SSLCACertificateFile.
 ##
 ## Conversion done with mk-ca-bundle.pl version 1.29.
-## SHA256: 8944ec6b572b577daee4fc681a425881f841ec2660e4cb5f0eee727f84620697
+## SHA256: 039132bff5179ce57cec5803ba59fe37abe6d0297aeb538c5af27847f0702517
 ##
 
 
@@ -3508,6 +3508,51 @@
 n/mtd+ArY0+ew+43u3gJhJ65bvspmZDogNOfJA==
 -----END CERTIFICATE-----
 
+TrustAsia TLS ECC Root CA
+=========================
+-----BEGIN CERTIFICATE-----
+MIICMTCCAbegAwIBAgIUNnThTXxlE8msg1UloD5Sfi9QaMcwCgYIKoZIzj0EAwMwWDELMAkGA1UE
+BhMCQ04xJTAjBgNVBAoTHFRydXN0QXNpYSBUZWNobm9sb2dpZXMsIEluYy4xIjAgBgNVBAMTGVRy
+dXN0QXNpYSBUTFMgRUNDIFJvb3QgQ0EwHhcNMjQwNTE1MDU0MTU2WhcNNDQwNTE1MDU0MTU1WjBY
+MQswCQYDVQQGEwJDTjElMCMGA1UEChMcVHJ1c3RBc2lhIFRlY2hub2xvZ2llcywgSW5jLjEiMCAG
+A1UEAxMZVHJ1c3RBc2lhIFRMUyBFQ0MgUm9vdCBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLh/
+pVs/AT598IhtrimY4ZtcU5nb9wj/1WrgjstEpvDBjL1P1M7UiFPoXlfXTr4sP/MSpwDpguMqWzJ8
+S5sUKZ74LYO1644xST0mYekdcouJtgq7nDM1D9rs3qlKH8kzsaNCMEAwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQULIVTu7FDzTLqnqOH/qKYqKaT6RAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49
+BAMDA2gAMGUCMFRH18MtYYZI9HlaVQ01L18N9mdsd0AaRuf4aFtOJx24mH1/k78ITcTaRTChD15K
+eAIxAKORh/IRM4PDwYqROkwrULG9IpRdNYlzg8WbGf60oenUoWa2AaU2+dhoYSi3dOGiMQ==
+-----END CERTIFICATE-----
+
+TrustAsia TLS RSA Root CA
+=========================
+-----BEGIN CERTIFICATE-----
+MIIFgDCCA2igAwIBAgIUHBjYz+VTPyI1RlNUJDxsR9FcSpwwDQYJKoZIhvcNAQEMBQAwWDELMAkG
+A1UEBhMCQ04xJTAjBgNVBAoTHFRydXN0QXNpYSBUZWNobm9sb2dpZXMsIEluYy4xIjAgBgNVBAMT
+GVRydXN0QXNpYSBUTFMgUlNBIFJvb3QgQ0EwHhcNMjQwNTE1MDU0MTU3WhcNNDQwNTE1MDU0MTU2
+WjBYMQswCQYDVQQGEwJDTjElMCMGA1UEChMcVHJ1c3RBc2lhIFRlY2hub2xvZ2llcywgSW5jLjEi
+MCAGA1UEAxMZVHJ1c3RBc2lhIFRMUyBSU0EgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIP
+ADCCAgoCggIBAMMWuBtqpERz5dZO9LnPWwvB0ZqB9WOwj0PBuwhaGnrhB3YmH49pVr7+NmDQDIPN
+lOrnxS1cLwUWAp4KqC/lYCZUlviYQB2srp10Zy9U+5RjmOMmSoPGlbYJQ1DNDX3eRA5gEk9bNb2/
+mThtfWza4mhzH/kxpRkQcwUqwzIZheo0qt1CHjCNP561HmHVb70AcnKtEj+qpklz8oYVlQwQX1Fk
+zv93uMltrOXVmPGZLmzjyUT5tUMnCE32ft5EebuyjBza00tsLtbDeLdM1aTk2tyKjg7/D8OmYCYo
+zza/+lcK7Fs/6TAWe8TbxNRkoDD75f0dcZLdKY9BWN4ArTr9PXwaqLEX8E40eFgl1oUh63kd0Nyr
+z2I8sMeXi9bQn9P+PN7F4/w6g3CEIR0JwqH8uyghZVNgepBtljhb//HXeltt08lwSUq6HTrQUNoy
+IBnkiz/r1RYmNzz7dZ6wB3C4FGB33PYPXFIKvF1tjVEK2sUYyJtt3LCDs3+jTnhMmCWr8n4uIF6C
+FabW2I+s5c0yhsj55NqJ4js+k8UTav/H9xj8Z7XvGCxUq0DTbE3txci3OE9kxJRMT6DNrqXGJyV1
+J23G2pyOsAWZ1SgRxSHUuPzHlqtKZFlhaxP8S8ySpg+kUb8OWJDZgoM5pl+z+m6Ss80zDoWo8SnT
+q1mt1tve1CuBAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLgHkXlcBvRG/XtZ
+ylomkadFK/hTMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQwFAAOCAgEAIZtqBSBdGBanEqT3
+Rz/NyjuujsCCztxIJXgXbODgcMTWltnZ9r96nBO7U5WS/8+S4PPFJzVXqDuiGev4iqME3mmL5Dw8
+veWv0BIb5Ylrc5tvJQJLkIKvQMKtuppgJFqBTQUYo+IzeXoLH5Pt7DlK9RME7I10nYEKqG/odv6L
+TytpEoYKNDbdgptvT+Bz3Ul/KD7JO6NXBNiT2Twp2xIQaOHEibgGIOcberyxk2GaGUARtWqFVwHx
+tlotJnMnlvm5P1vQiJ3koP26TpUJg3933FEFlJ0gcXax7PqJtZwuhfG5WyRasQmr2soaB82G39tp
+27RIGAAtvKLEiUUjpQ7hRGU+isFqMB3iYPg6qocJQrmBktwliJiJ8Xw18WLK7nn4GS/+X/jbh87q
+qA8MpugLoDzga5SYnH+tBuYc6kIQX+ImFTw3OffXvO645e8D7r0i+yiGNFjEWn9hongPXvPKnbwb
+PKfILfanIhHKA9jnZwqKDss1jjQ52MjqjZ9k4DewbNfFj8GQYSbbJIweSsCI3zWQzj8C9GRh3sfI
+B5XeMhg6j6JCQCTl1jNdfK7vsU1P1FeQNWrcrgSXSYk0ly4wBOeY99sLAZDBHwo/+ML+TvrbmnNz
+FrwFuHnYWa8G5z9nODmxfKuU4CkUpijy323imttUQ/hHWKNddBWcwauwxzQ=
+-----END CERTIFICATE-----
+
 D-TRUST EV Root CA 2 2023
 =========================
 -----BEGIN CERTIFICATE-----
@@ -3538,3 +3583,79 @@
 HxiMkl14p3ZnGbuy6n/pcAlWVqOwDAstNl7F6cTVg8uGF5csbBNvh1qvSaYd2804BC5f4ko1Di1L
 +KIkBI3Y4WNeApI02phhXBxvWHZks/wCuPWdCg==
 -----END CERTIFICATE-----
+
+SwissSign RSA TLS Root CA 2022 - 1
+==================================
+-----BEGIN CERTIFICATE-----
+MIIFkzCCA3ugAwIBAgIUQ/oMX04bgBhE79G0TzUfRPSA7cswDQYJKoZIhvcNAQELBQAwUTELMAkG
+A1UEBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzErMCkGA1UEAxMiU3dpc3NTaWduIFJTQSBU
+TFMgUm9vdCBDQSAyMDIyIC0gMTAeFw0yMjA2MDgxMTA4MjJaFw00NzA2MDgxMTA4MjJaMFExCzAJ
+BgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxKzApBgNVBAMTIlN3aXNzU2lnbiBSU0Eg
+VExTIFJvb3QgQ0EgMjAyMiAtIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDLKmji
+C8NXvDVjvHClO/OMPE5Xlm7DTjak9gLKHqquuN6orx122ro10JFwB9+zBvKK8i5VUXu7LCTLf5Im
+gKO0lPaCoaTo+nUdWfMHamFk4saMla+ju45vVs9xzF6BYQ1t8qsCLqSX5XH8irCRIFucdFJtrhUn
+WXjyCcplDn/L9Ovn3KlMd/YrFgSVrpxxpT8q2kFC5zyEEPThPYxr4iuRR1VPuFa+Rd4iUU1OKNlf
+GUEGjw5NBuBwQCMBauTLE5tzrE0USJIt/m2n+IdreXXhvhCxqohAWVTXz8TQm0SzOGlkjIHRI36q
+OTw7D59Ke4LKa2/KIj4x0LDQKhySio/YGZxH5D4MucLNvkEM+KRHBdvBFzA4OmnczcNpI/2aDwLO
+EGrOyvi5KaM2iYauC8BPY7kGWUleDsFpswrzd34unYyzJ5jSmY0lpx+Gs6ZUcDj8fV3oT4MM0ZPl
+EuRU2j7yrTrePjxF8CgPBrnh25d7mUWe3f6VWQQvdT/TromZhqwUtKiE+shdOxtYk8EXlFXIC+OC
+eYSf8wCENO7cMdWP8vpPlkwGqnj73mSiI80fPsWMvDdUDrtaclXvyFu1cvh43zcgTFeRc5JzrBh3
+Q4IgaezprClG5QtO+DdziZaKHG29777YtvTKwP1H8K4LWCDFyB02rpeNUIMmJCn3nTsPBQIDAQAB
+o2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBRvjmKLk0Ow
+4UD2p8P98Q+4DxU4pTAdBgNVHQ4EFgQUb45ii5NDsOFA9qfD/fEPuA8VOKUwDQYJKoZIhvcNAQEL
+BQADggIBAKwsKUF9+lz1GpUYvyypiqkkVHX1uECry6gkUSsYP2OprphWKwVDIqO310aewCoSPY6W
+lkDfDDOLazeROpW7OSltwAJsipQLBwJNGD77+3v1dj2b9l4wBlgzHqp41eZUBDqyggmNzhYzWUUo
+8aWjlw5DI/0LIICQ/+Mmz7hkkeUFjxOgdg3XNwwQiJb0Pr6VvfHDffCjw3lHC1ySFWPtUnWK50Zp
+y1FVCypM9fJkT6lc/2cyjlUtMoIcgC9qkfjLvH4YoiaoLqNTKIftV+Vlek4ASltOU8liNr3Cjlvr
+zG4ngRhZi0Rjn9UMZfQpZX+RLOV/fuiJz48gy20HQhFRJjKKLjpHE7iNvUcNCfAWpO2Whi4Z2L6M
+OuhFLhG6rlrnub+xzI/goP+4s9GFe3lmozm1O2bYQL7Pt2eLSMkZJVX8vY3PXtpOpvJpzv1/THfQ
+wUY1mFwjmwJFQ5Ra3bxHrSL+ul4vkSkphnsh3m5kt8sNjzdbowhq6/TdAo9QAwKxuDdollDruF/U
+KIqlIgyKhPBZLtU30WHlQnNYKoH3dtvi4k0NX/a3vgW0rk4N3hY9A4GzJl5LuEsAz/+MF7psYC0n
+hzck5npgL7XTgwSqT0N1osGDsieYK7EOgLrAhV5Cud+xYJHT6xh+cHiudoO+cVrQkOPKwRYlZ0rw
+tnu64ZzZ
+-----END CERTIFICATE-----
+
+OISTE Server Root ECC G1
+========================
+-----BEGIN CERTIFICATE-----
+MIICNTCCAbqgAwIBAgIQI/nD1jWvjyhLH/BU6n6XnTAKBggqhkjOPQQDAzBLMQswCQYDVQQGEwJD
+SDEZMBcGA1UECgwQT0lTVEUgRm91bmRhdGlvbjEhMB8GA1UEAwwYT0lTVEUgU2VydmVyIFJvb3Qg
+RUNDIEcxMB4XDTIzMDUzMTE0NDIyOFoXDTQ4MDUyNDE0NDIyN1owSzELMAkGA1UEBhMCQ0gxGTAX
+BgNVBAoMEE9JU1RFIEZvdW5kYXRpb24xITAfBgNVBAMMGE9JU1RFIFNlcnZlciBSb290IEVDQyBH
+MTB2MBAGByqGSM49AgEGBSuBBAAiA2IABBcv+hK8rBjzCvRE1nZCnrPoH7d5qVi2+GXROiFPqOuj
+vqQycvO2Ackr/XeFblPdreqqLiWStukhEaivtUwL85Zgmjvn6hp4LrQ95SjeHIC6XG4N2xml4z+c
+KrhAS93mT6NjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBQ3TYhlz/w9itWj8UnATgwQ
+b0K0nDAdBgNVHQ4EFgQUN02IZc/8PYrVo/FJwE4MEG9CtJwwDgYDVR0PAQH/BAQDAgGGMAoGCCqG
+SM49BAMDA2kAMGYCMQCpKjAd0MKfkFFRQD6VVCHNFmb3U2wIFjnQEnx/Yxvf4zgAOdktUyBFCxxg
+ZzFDJe0CMQCSia7pXGKDYmH5LVerVrkR3SW+ak5KGoJr3M/TvEqzPNcum9v4KGm8ay3sMaE641c=
+-----END CERTIFICATE-----
+
+ OISTE Server Root RSA G1
+=========================
+-----BEGIN CERTIFICATE-----
+MIIFgzCCA2ugAwIBAgIQVaXZZ5Qoxu0M+ifdWwFNGDANBgkqhkiG9w0BAQwFADBLMQswCQYDVQQG
+EwJDSDEZMBcGA1UECgwQT0lTVEUgRm91bmRhdGlvbjEhMB8GA1UEAwwYT0lTVEUgU2VydmVyIFJv
+b3QgUlNBIEcxMB4XDTIzMDUzMTE0MzcxNloXDTQ4MDUyNDE0MzcxNVowSzELMAkGA1UEBhMCQ0gx
+GTAXBgNVBAoMEE9JU1RFIEZvdW5kYXRpb24xITAfBgNVBAMMGE9JU1RFIFNlcnZlciBSb290IFJT
+QSBHMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKqu9KuCz/vlNwvn1ZatkOhLKdxV
+YOPMvLO8LZK55KN68YG0nnJyQ98/qwsmtO57Gmn7KNByXEptaZnwYx4M0rH/1ow00O7brEi56rAU
+jtgHqSSY3ekJvqgiG1k50SeH3BzN+Puz6+mTeO0Pzjd8JnduodgsIUzkik/HEzxux9UTl7Ko2yRp
+g1bTacuCErudG/L4NPKYKyqOBGf244ehHa1uzjZ0Dl4zO8vbUZeUapU8zhhabkvG/AePLhq5Svdk
+NCncpo1Q4Y2LS+VIG24ugBA/5J8bZT8RtOpXaZ+0AOuFJJkk9SGdl6r7NH8CaxWQrbueWhl/pIzY
++m0o/DjH40ytas7ZTpOSjswMZ78LS5bOZmdTaMsXEY5Z96ycG7mOaES3GK/m5Q9l3JUJsJMStR8+
+lKXHiHUhsd4JJCpM4rzsTGdHwimIuQq6+cF0zowYJmXa92/GjHtoXAvuY8BeS/FOzJ8vD+HomnqT
+8eDI278n5mUpezbgMxVz8p1rhAhoKzYHKyfMeNhqhw5HdPSqoBNdZH702xSu+zrkL8Fl47l6QGzw
+Brd7KJvX4V84c5Ss2XCTLdyEr0YconosP4EmQufU2MVshGYRi3drVByjtdgQ8K4p92cIiBdcuJd5
+z+orKu5YM+Vt6SmqZQENghPsJQtdLEByFSnTkCz3GkPVavBpAgMBAAGjYzBhMA8GA1UdEwEB/wQF
+MAMBAf8wHwYDVR0jBBgwFoAU8snBDw1jALvsRQ5KH7WxszbNDo0wHQYDVR0OBBYEFPLJwQ8NYwC7
+7EUOSh+1sbM2zQ6NMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQwFAAOCAgEANGd5sjrG5T33
+I3K5Ce+SrScfoE4KsvXaFwyihdJ+klH9FWXXXGtkFu6KRcoMQzZENdl//nk6HOjG5D1rd9QhEOP2
+8yBOqb6J8xycqd+8MDoX0TJD0KqKchxRKEzdNsjkLWd9kYccnbz8qyiWXmFcuCIzGEgWUOrKL+ml
+Sdx/PKQZvDatkuK59EvV6wit53j+F8Bdh3foZ3dPAGav9LEDOr4SfEE15fSmG0eLy3n31r8Xbk5l
+8PjaV8GUgeV6Vg27Rn9vkf195hfkgSe7BYhW3SCl95gtkRlpMV+bMPKZrXJAlszYd2abtNUOshD+
+FKrDgHGdPY3ofRRsYWSGRqbXVMW215AWRqWFyp464+YTFrYVI8ypKVL9AMb2kI5Wj4kI3Zaq5tNq
+qYY19tVFeEJKRvwDyF7YZvZFZSS0vod7VSCd9521Kvy5YhnLbDuv0204bKt7ph6N/Ome/msVuduC
+msuY33OhkKCgxeDoAaijFJzIwZqsFVAzje18KotzlUBDJvyBpCpfOZC3J8tRd/iWkx7P8nd9H0aT
+olkelUTFLXVksNb54Dxp6gS1HAviRkRNQzuXSXERvSS2wq1yVAb+axj5d9spLFKebXd7Yv0PTY6Y
+MjAwcRLWJTXjn/hvnLXrahut6hDTlhZyBiElxky8j3C7DOReIoMt0r7+hVu05L0=
+-----END CERTIFICATE-----
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/class-wp-block-patterns-registry.php wordpress-6.8.6+dfsg1/wp-includes/class-wp-block-patterns-registry.php
--- wordpress-6.8.3+dfsg1/wp-includes/class-wp-block-patterns-registry.php	2024-09-27 09:20:18.500848000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/class-wp-block-patterns-registry.php	2026-03-11 00:47:34.707114000 +0000
@@ -173,12 +173,23 @@
 		} else {
 			$patterns = &$this->registered_patterns;
 		}
-		if ( ! isset( $patterns[ $pattern_name ]['content'] ) && isset( $patterns[ $pattern_name ]['filePath'] ) ) {
+
+		$file_path    = $patterns[ $pattern_name ]['filePath'] ?? '';
+		$is_stringy   = is_string( $file_path ) || ( is_object( $file_path ) && method_exists( $file_path, '__toString' ) );
+		$pattern_path = $is_stringy ? realpath( (string) $file_path ) : null;
+		if (
+			! isset( $patterns[ $pattern_name ]['content'] ) &&
+			is_string( $pattern_path ) &&
+			( str_ends_with( $pattern_path, '.php' ) || str_ends_with( $pattern_path, '.html' ) ) &&
+			is_file( $pattern_path ) &&
+			is_readable( $pattern_path )
+		) {
 			ob_start();
 			include $patterns[ $pattern_name ]['filePath'];
 			$patterns[ $pattern_name ]['content'] = ob_get_clean();
 			unset( $patterns[ $pattern_name ]['filePath'] );
 		}
+
 		return $patterns[ $pattern_name ]['content'];
 	}
 
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/class-wp-http-ixr-client.php wordpress-6.8.6+dfsg1/wp-includes/class-wp-http-ixr-client.php
--- wordpress-6.8.3+dfsg1/wp-includes/class-wp-http-ixr-client.php	2022-09-12 15:47:14.935318000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/class-wp-http-ixr-client.php	2026-03-10 16:37:37.009287000 +0000
@@ -89,7 +89,7 @@
 			echo '<pre class="ixr_request">' . htmlspecialchars( $xml ) . "\n</pre>\n\n";
 		}
 
-		$response = wp_remote_post( $url, $args );
+		$response = wp_safe_remote_post( $url, $args );
 
 		if ( is_wp_error( $response ) ) {
 			$errno       = $response->get_error_code();
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/class-wp-query.php wordpress-6.8.6+dfsg1/wp-includes/class-wp-query.php
--- wordpress-6.8.3+dfsg1/wp-includes/class-wp-query.php	2025-03-18 23:34:26.631416000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/class-wp-query.php	2026-07-17 16:40:38.510502000 +0000
@@ -2401,12 +2401,16 @@
 		}
 
 		if ( ! empty( $q['author__not_in'] ) ) {
-			if ( is_array( $q['author__not_in'] ) ) {
-				$q['author__not_in'] = array_unique( array_map( 'absint', $q['author__not_in'] ) );
-				sort( $q['author__not_in'] );
+			$author__not_in_id_list = wp_parse_id_list( $q['author__not_in'] );
+			if ( count( $author__not_in_id_list ) > 0 ) {
+				sort( $author__not_in_id_list );
+				$where .= sprintf(
+					" AND {$wpdb->posts}.post_author NOT IN (%s) ",
+					implode( ',', $author__not_in_id_list )
+				);
+				/** Update the query var for stable cache key generation in {@see self::generate_cache_key()}. */
+				$q['author__not_in'] = $author__not_in_id_list;
 			}
-			$author__not_in = implode( ',', (array) $q['author__not_in'] );
-			$where         .= " AND {$wpdb->posts}.post_author NOT IN ($author__not_in) ";
 		} elseif ( ! empty( $q['author__in'] ) ) {
 			if ( is_array( $q['author__in'] ) ) {
 				$q['author__in'] = array_unique( array_map( 'absint', $q['author__in'] ) );
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/html-api/class-wp-html-tag-processor.php wordpress-6.8.6+dfsg1/wp-includes/html-api/class-wp-html-tag-processor.php
--- wordpress-6.8.3+dfsg1/wp-includes/html-api/class-wp-html-tag-processor.php	2025-02-11 20:04:23.371642000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/html-api/class-wp-html-tag-processor.php	2026-03-10 16:37:37.009287000 +0000
@@ -4564,4 +4564,13 @@
 	 * @since 6.7.0
 	 */
 	const TEXT_IS_WHITESPACE = 'TEXT_IS_WHITESPACE';
+
+	/**
+	 * Wakeup magic method.
+	 *
+	 * @since 6.9.2
+	 */
+	public function __wakeup() {
+		throw new \LogicException( __CLASS__ . ' should never be unserialized' );
+	}
 }
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/interactivity-api/class-wp-interactivity-api.php wordpress-6.8.6+dfsg1/wp-includes/interactivity-api/class-wp-interactivity-api.php
--- wordpress-6.8.3+dfsg1/wp-includes/interactivity-api/class-wp-interactivity-api.php	2025-03-24 14:53:28.078503000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/interactivity-api/class-wp-interactivity-api.php	2026-03-11 00:47:34.707114000 +0000
@@ -868,6 +868,20 @@
 					return;
 				}
 
+				// Skip if the bound attribute is an event handler.
+				if ( str_starts_with( $bound_attribute, 'on' ) ) {
+					_doing_it_wrong(
+						__METHOD__,
+						sprintf(
+							/* translators: %s: The directive, e.g. data-wp-on--click. */
+							__( 'Binding event handler attributes is not supported. Please use "%s" instead.' ),
+							esc_attr( 'data-wp-on--' . substr( $bound_attribute, 2 ) )
+						),
+						'6.8.5'
+					);
+					continue;
+				}
+
 				$attribute_value = $p->get_attribute( $attribute_name );
 				$result          = $this->evaluate( $attribute_value );
 
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/js/wp-util.js wordpress-6.8.6+dfsg1/wp-includes/js/wp-util.js
--- wordpress-6.8.3+dfsg1/wp-includes/js/wp-util.js	2022-09-20 03:52:10.081046000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/js/wp-util.js	2026-03-10 16:37:37.009287000 +0000
@@ -36,10 +36,11 @@
 			};
 
 		return function ( data ) {
-			if ( ! document.getElementById( 'tmpl-' + id ) ) {
+			var el = document.querySelector( 'script#tmpl-' + id );
+			if ( ! el ) {
 				throw new Error( 'Template not found: ' + '#tmpl-' + id );
 			}
-			compiled = compiled || _.template( $( '#tmpl-' + id ).html(),  options );
+			compiled = compiled || _.template( $( el ).html(), options );
 			return compiled( data );
 		};
 	});
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/js/wp-util.min.js wordpress-6.8.6+dfsg1/wp-includes/js/wp-util.min.js
--- wordpress-6.8.3+dfsg1/wp-includes/js/wp-util.min.js	2025-02-06 17:27:26.356615000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/js/wp-util.min.js	2026-03-10 16:37:37.009287000 +0000
@@ -1,2 +1,2 @@
 /*! This file is auto-generated */
-window.wp=window.wp||{},function(s){var t="undefined"==typeof _wpUtilSettings?{}:_wpUtilSettings;wp.template=_.memoize(function(e){var n,a={evaluate:/<#([\s\S]+?)#>/g,interpolate:/\{\{\{([\s\S]+?)\}\}\}/g,escape:/\{\{([^\}]+?)\}\}(?!\})/g,variable:"data"};return function(t){if(document.getElementById("tmpl-"+e))return(n=n||_.template(s("#tmpl-"+e).html(),a))(t);throw new Error("Template not found: #tmpl-"+e)}}),wp.ajax={settings:t.ajax||{},post:function(t,e){return wp.ajax.send({data:_.isObject(t)?t:_.extend(e||{},{action:t})})},send:function(a,t){var e,n;return _.isObject(a)?t=a:(t=t||{}).data=_.extend(t.data||{},{action:a}),t=_.defaults(t||{},{type:"POST",url:wp.ajax.settings.url,context:this}),(e=(n=s.Deferred(function(n){t.success&&n.done(t.success),t.error&&n.fail(t.error),delete t.success,delete t.error,n.jqXHR=s.ajax(t).done(function(t){var e;"1"!==t&&1!==t||(t={success:!0}),_.isObject(t)&&!_.isUndefined(t.success)?(e=this,n.done(function(){a&&a.data&&"query-attachments"===a.data.action&&n.jqXHR.hasOwnProperty("getResponseHeader")&&n.jqXHR.getResponseHeader("X-WP-Total")?e.totalAttachments=parseInt(n.jqXHR.getResponseHeader("X-WP-Total"),10):e.totalAttachments=0}),n[t.success?"resolveWith":"rejectWith"](this,[t.data])):n.rejectWith(this,[t])}).fail(function(){n.rejectWith(this,arguments)})})).promise()).abort=function(){return n.jqXHR.abort(),this},e}}}(jQuery);
\ No newline at end of file
+window.wp=window.wp||{},function(r){var t="undefined"==typeof _wpUtilSettings?{}:_wpUtilSettings;wp.template=_.memoize(function(a){var n,s={evaluate:/<#([\s\S]+?)#>/g,interpolate:/\{\{\{([\s\S]+?)\}\}\}/g,escape:/\{\{([^\}]+?)\}\}(?!\})/g,variable:"data"};return function(t){var e=document.querySelector("script#tmpl-"+a);if(e)return(n=n||_.template(r(e).html(),s))(t);throw new Error("Template not found: #tmpl-"+a)}}),wp.ajax={settings:t.ajax||{},post:function(t,e){return wp.ajax.send({data:_.isObject(t)?t:_.extend(e||{},{action:t})})},send:function(n,t){var e,a;return _.isObject(n)?t=n:(t=t||{}).data=_.extend(t.data||{},{action:n}),t=_.defaults(t||{},{type:"POST",url:wp.ajax.settings.url,context:this}),(e=(a=r.Deferred(function(a){t.success&&a.done(t.success),t.error&&a.fail(t.error),delete t.success,delete t.error,a.jqXHR=r.ajax(t).done(function(t){var e;"1"!==t&&1!==t||(t={success:!0}),_.isObject(t)&&!_.isUndefined(t.success)?(e=this,a.done(function(){n&&n.data&&"query-attachments"===n.data.action&&a.jqXHR.hasOwnProperty("getResponseHeader")&&a.jqXHR.getResponseHeader("X-WP-Total")?e.totalAttachments=parseInt(a.jqXHR.getResponseHeader("X-WP-Total"),10):e.totalAttachments=0}),a[t.success?"resolveWith":"rejectWith"](this,[t.data])):a.rejectWith(this,[t])}).fail(function(){a.rejectWith(this,arguments)})})).promise()).abort=function(){return a.jqXHR.abort(),this},e}}}(jQuery);
\ No newline at end of file
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/kses.php wordpress-6.8.6+dfsg1/wp-includes/kses.php
--- wordpress-6.8.3+dfsg1/wp-includes/kses.php	2025-01-21 22:59:18.398718000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/kses.php	2026-03-10 16:37:37.009287000 +0000
@@ -1964,8 +1964,8 @@
 	} else {
 		$content = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $content );
 	}
-	$content = preg_replace_callback( '/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $content );
-	$content = preg_replace_callback( '/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $content );
+	$content = preg_replace_callback( '/&amp;#(0*[1-9][0-9]{0,6});/', 'wp_kses_normalize_entities2', $content );
+	$content = preg_replace_callback( '/&amp;#[Xx](0*[1-9A-Fa-f][0-9A-Fa-f]{0,5});/', 'wp_kses_normalize_entities3', $content );
 
 	return $content;
 }
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/media.php wordpress-6.8.6+dfsg1/wp-includes/media.php
--- wordpress-6.8.3+dfsg1/wp-includes/media.php	2025-07-07 17:09:41.340868000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/media.php	2026-03-10 16:37:37.009287000 +0000
@@ -4558,7 +4558,7 @@
 
 	if ( $attachment->post_parent ) {
 		$post_parent = get_post( $attachment->post_parent );
-		if ( $post_parent ) {
+		if ( $post_parent && current_user_can( 'read_post', $attachment->post_parent ) ) {
 			$response['uploadedToTitle'] = $post_parent->post_title ? $post_parent->post_title : __( '(no title)' );
 			$response['uploadedToLink']  = get_edit_post_link( $attachment->post_parent, 'raw' );
 		}
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/nav-menu.php wordpress-6.8.6+dfsg1/wp-includes/nav-menu.php
--- wordpress-6.8.3+dfsg1/wp-includes/nav-menu.php	2024-08-05 19:00:19.442608000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/nav-menu.php	2026-03-10 16:37:37.009287000 +0000
@@ -514,7 +514,7 @@
 			}
 		}
 
-		if ( wp_unslash( $args['menu-item-title'] ) === wp_specialchars_decode( $original_title ) ) {
+		if ( wp_unslash( $args['menu-item-title'] ) === $original_title ) {
 			$args['menu-item-title'] = '';
 		}
 
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/rest-api/class-wp-rest-server.php wordpress-6.8.6+dfsg1/wp-includes/rest-api/class-wp-rest-server.php
--- wordpress-6.8.3+dfsg1/wp-includes/rest-api/class-wp-rest-server.php	2025-02-27 03:39:25.567462000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/rest-api/class-wp-rest-server.php	2026-07-17 16:40:38.510502000 +0000
@@ -283,6 +283,12 @@
 	 * @return null|false Null if not served and a HEAD request, false otherwise.
 	 */
 	public function serve_request( $path = null ) {
+		// Refuse to start a fresh top-level REST cycle while another dispatch
+		// is already in flight. Internal sub-requests must use dispatch().
+		if ( $this->is_dispatching() ) {
+			return false;
+		}
+
 		/* @var WP_User|null $current_user */
 		global $current_user;
 
@@ -1753,6 +1759,13 @@
 		$has_error  = false;
 
 		foreach ( $requests as $single_request ) {
+			if ( is_wp_error( $single_request ) ) {
+				$has_error    = true;
+				$matches[]    = $single_request;
+				$validation[] = $single_request;
+				continue;
+			}
+
 			$match     = $this->match_request_to_handler( $single_request );
 			$matches[] = $match;
 			$error     = null;
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/rest-api.php wordpress-6.8.6+dfsg1/wp-includes/rest-api.php
--- wordpress-6.8.3+dfsg1/wp-includes/rest-api.php	2025-03-28 22:44:29.347097000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/rest-api.php	2026-07-17 16:40:38.510502000 +0000
@@ -430,6 +430,15 @@
 		return;
 	}
 
+	// Short-circuit before define()/die() if a REST dispatch is already in flight.
+	// serve_request() enforces this too; guarding here avoids the trailing die().
+	if ( isset( $GLOBALS['wp_rest_server'] )
+		&& $GLOBALS['wp_rest_server'] instanceof WP_REST_Server
+		&& $GLOBALS['wp_rest_server']->is_dispatching()
+	) {
+		return;
+	}
+
 	// Return an error message if query_var is not a string.
 	if ( ! is_string( $GLOBALS['wp']->query_vars['rest_route'] ) ) {
 		$rest_type_error = new WP_Error(
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/template-loader.php wordpress-6.8.6+dfsg1/wp-includes/template-loader.php
--- wordpress-6.8.3+dfsg1/wp-includes/template-loader.php	2020-05-26 09:37:10.929415000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/template-loader.php	2026-03-11 00:47:34.707114000 +0000
@@ -101,8 +101,15 @@
 	 *
 	 * @param string $template The path of the template to include.
 	 */
-	$template = apply_filters( 'template_include', $template );
-	if ( $template ) {
+	$template   = apply_filters( 'template_include', $template );
+	$is_stringy = is_string( $template ) || ( is_object( $template ) && method_exists( $template, '__toString' ) );
+	$template   = $is_stringy ? realpath( (string) $template ) : null;
+	if (
+		is_string( $template ) &&
+		( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&
+		is_file( $template ) &&
+		is_readable( $template )
+	) {
 		include $template;
 	} elseif ( current_user_can( 'switch_themes' ) ) {
 		$theme = wp_get_theme();
diff -Nru wordpress-6.8.3+dfsg1/wp-includes/version.php wordpress-6.8.6+dfsg1/wp-includes/version.php
--- wordpress-6.8.3+dfsg1/wp-includes/version.php	2025-09-30 17:30:38.000000000 +0000
+++ wordpress-6.8.6+dfsg1/wp-includes/version.php	2026-07-17 17:55:58.000000000 +0000
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.8.3';
+$wp_version = '6.8.6';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.