diff --git a/NEWS b/NEWS
index bb9d4ec331b..827d2e21137 100644
--- a/NEWS
+++ b/NEWS
@@ -31,6 +31,9 @@ PHP                                                                        NEWS
   . Fix zend_jit_find_trace() crashes. (Max Kellermann)
   . Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit. (Max Kellermann)
 
+- Phar:
+  . Fix wrong flags check for compression method in phar_object.c (nielsdos)
+
 - PHPDBG:
   . Fix undefined behaviour in phpdbg_load_module_or_extension(). (nielsdos)
   . Fix NULL pointer dereference in phpdbg_create_conditional_breal(). (nielsdos)
@@ -46,6 +49,10 @@ PHP                                                                        NEWS
   . Fix GH-10187 (Segfault in stripslashes() with arm64). (nielsdos)
   . Fixed bug GH-10214 (Incomplete validation of object syntax during
     unserialize()). (timwolla)
+  . Fix substr_replace with slots in repl_ht being UNDEF. (nielsdos)
+
+- XMLWriter
+  . Fix missing check for xmlTextWriterEndElement (nielsdos)
 
 05 Jan 2023, PHP 8.2.1
 
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 5421b12198e..0e9f492b61f 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -3314,7 +3314,7 @@ PHP_METHOD(Phar, compressFiles)
 	}
 
 	if (!pharobj_cancompress(&phar_obj->archive->manifest)) {
-		if (flags == PHAR_FILE_COMPRESSED_GZ) {
+		if (flags == PHAR_ENT_COMPRESSED_GZ) {
 			zend_throw_exception_ex(spl_ce_BadMethodCallException, 0,
 				"Cannot compress all files as Gzip, some are compressed as bzip2 and cannot be decompressed");
 		} else {
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 2198467926d..192a8b1602a 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2365,7 +2365,7 @@ PHP_FUNCTION(substr_replace)
 				if (HT_IS_PACKED(repl_ht)) {
 					while (repl_idx < repl_ht->nNumUsed) {
 						tmp_repl = &repl_ht->arPacked[repl_idx];
-						if (repl_ht != IS_UNDEF) {
+						if (Z_TYPE_P(tmp_repl) != IS_UNDEF) {
 							break;
 						}
 						repl_idx++;
@@ -2373,7 +2373,7 @@ PHP_FUNCTION(substr_replace)
 				} else {
 					while (repl_idx < repl_ht->nNumUsed) {
 						tmp_repl = &repl_ht->arData[repl_idx].val;
-						if (repl_ht != IS_UNDEF) {
+						if (Z_TYPE_P(tmp_repl) != IS_UNDEF) {
 							break;
 						}
 						repl_idx++;
diff --git a/ext/standard/tests/strings/substr_replace_array_unset.phpt b/ext/standard/tests/strings/substr_replace_array_unset.phpt
new file mode 100644
index 00000000000..ff253d39844
--- /dev/null
+++ b/ext/standard/tests/strings/substr_replace_array_unset.phpt
@@ -0,0 +1,27 @@
+--TEST--
+substr_replace() function - array with unset
+--FILE--
+<?php
+
+$replacement = ['A', 'C', 'B'];
+unset($replacement[1]);
+$newarr = substr_replace(['1 string', '2 string'], $replacement, 0);
+print_r($newarr);
+
+$replacement = ['foo', 42 => 'bar', 'baz'];
+unset($replacement[42]);
+$newarr = substr_replace(['1 string', '2 string'], $replacement, 0);
+print_r($newarr);
+
+?>
+--EXPECT--
+Array
+(
+    [0] => A
+    [1] => B
+)
+Array
+(
+    [0] => foo
+    [1] => baz
+)
diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index 8d4abb3d26b..68961429dea 100644
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -449,7 +449,7 @@ PHP_FUNCTION(xmlwriter_write_element)
 			if (retval == -1) {
 				RETURN_FALSE;
 			}
-			xmlTextWriterEndElement(ptr);
+			retval = xmlTextWriterEndElement(ptr);
 			if (retval == -1) {
 				RETURN_FALSE;
 			}