php: CVE fixes for 5.3.28
php: bump release