diff --git a/NEWS b/NEWS
index 363c52506403..c7645ca27b8a 100644
--- a/NEWS
+++ b/NEWS
@@ -81,6 +81,8 @@ PHP                                                                        NEWS
     transliterator_transliterate(). (Weilin Du)
   . Fixed IntlTimeZone::getDisplayName() to synchronize object error state
     for invalid display types. (Weilin Du)
+  . Fixed Locale::lookup() and locale_lookup() to return NULL instead of the
+    fallback locale when a language tag cannot be canonicalized. (Weilin Du)
   . Added IntlNumberRangeFormatter class to format an interval of two numbers
     with a given skeleton, locale, collapse type and identity fallback.
     (BogdanUngureanu)
@@ -257,6 +259,8 @@ PHP                                                                        NEWS
     contains null bytes. (Weilin Du)
   . dl() now raises a ValueError when the $extension_filename argument
     contains null bytes. (Weilin Du)
+  . openlog() now raises a ValueError when the $prefix argument contains
+    null bytes. (Weilin Du)
   . parse_str() now raises a ValueError when the $string argument contains
     null bytes. (Weilin Du)
   . proc_open() now raises a ValueError when the $cwd argument contains
diff --git a/UPGRADING b/UPGRADING
index a9b1f34eae5a..c77bfbfa4e02 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -153,6 +153,8 @@ PHP 8.6 UPGRADE NOTES
     contains null bytes.
   . dl() now raises a ValueError when the $extension_filename argument
     contains null bytes.
+  . openlog() now raises a ValueError when the $prefix argument contains
+    null bytes.
   . parse_str() now raises a ValueError when the $string argument contains
     null bytes.
   . linkinfo() now raises a ValueError when the $path argument is empty.
diff --git a/ext/intl/locale/locale_methods.cpp b/ext/intl/locale/locale_methods.cpp
index 1ee32a2f094e..ffcba02d322d 100644
--- a/ext/intl/locale/locale_methods.cpp
+++ b/ext/intl/locale/locale_methods.cpp
@@ -1435,14 +1435,15 @@ static zend_string* lookup_loc_range(const char* loc_range, HashTable* hash_arr,
 			zend_argument_value_error(2, "must not contain any null bytes");
 			LOOKUP_CLEAN_RETURN(NULL);
 		}
-		cur_arr[cur_arr_len*2] = estrndup(Z_STRVAL_P(ele_value), Z_STRLEN_P(ele_value));
-		result = strToMatch(Z_STRVAL_P(ele_value), cur_arr[cur_arr_len*2]);
+		i = cur_arr_len*2;
+		cur_arr[i] = estrndup(Z_STRVAL_P(ele_value), Z_STRLEN_P(ele_value));
+		cur_arr_len++;
+		result = strToMatch(Z_STRVAL_P(ele_value), cur_arr[i]);
 		if(result == 0) {
 			intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR, "unable to canonicalize lang_tag");
 			LOOKUP_CLEAN_RETURN(NULL);
 		}
-		cur_arr[cur_arr_len*2+1] = Z_STRVAL_P(ele_value);
-		cur_arr_len++ ;
+		cur_arr[i+1] = Z_STRVAL_P(ele_value);
 	} ZEND_HASH_FOREACH_END(); /* end of for */
 
 	/* Canonicalize array elements */
@@ -1562,6 +1563,15 @@ U_CFUNC PHP_FUNCTION(locale_lookup)
 	}
 
 	result_str = lookup_loc_range(loc_range, hash_arr, boolCanonical);
+	if (EG(exception)) {
+		RETURN_THROWS();
+	}
+	if (U_FAILURE(intl_error_get_code(NULL))) {
+		if (result_str) {
+			zend_string_release_ex(result_str, 0);
+		}
+		RETURN_NULL();
+	}
 	if(result_str == NULL || ZSTR_VAL(result_str)[0] == '\0') {
 		if( fallback_loc_str ) {
 			result_str = zend_string_copy(fallback_loc_str);
diff --git a/ext/intl/tests/locale_lookup_invalid_language_tag.phpt b/ext/intl/tests/locale_lookup_invalid_language_tag.phpt
new file mode 100644
index 000000000000..3ba48f61334b
--- /dev/null
+++ b/ext/intl/tests/locale_lookup_invalid_language_tag.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Locale::lookup() returns null for invalid language tags
+--EXTENSIONS--
+intl
+--FILE--
+<?php
+
+var_dump(Locale::lookup([''], 'de-DE', false, 'en-US'));
+var_dump(intl_get_error_message());
+
+var_dump(locale_lookup([''], 'de-DE', false, 'en-US'));
+var_dump(intl_get_error_message());
+
+ini_set('intl.use_exceptions', '1');
+
+try {
+    Locale::lookup([''], 'de-DE', false, 'en-US');
+} catch (IntlException $e) {
+    echo $e->getMessage(), PHP_EOL;
+}
+
+try {
+    locale_lookup([''], 'de-DE', false, 'en-US');
+} catch (IntlException $e) {
+    echo $e->getMessage(), PHP_EOL;
+}
+
+?>
+--EXPECT--
+NULL
+string(75) "Locale::lookup(): unable to canonicalize lang_tag: U_ILLEGAL_ARGUMENT_ERROR"
+NULL
+string(74) "locale_lookup(): unable to canonicalize lang_tag: U_ILLEGAL_ARGUMENT_ERROR"
+Locale::lookup(): unable to canonicalize lang_tag
+locale_lookup(): unable to canonicalize lang_tag
diff --git a/ext/standard/syslog.c b/ext/standard/syslog.c
index 44b902bf50b8..78dfb2297fdc 100644
--- a/ext/standard/syslog.c
+++ b/ext/standard/syslog.c
@@ -61,7 +61,7 @@ PHP_FUNCTION(openlog)
 	size_t ident_len;
 
 	ZEND_PARSE_PARAMETERS_START(3, 3)
-		Z_PARAM_STRING(ident, ident_len)
+		Z_PARAM_PATH(ident, ident_len)
 		Z_PARAM_LONG(option)
 		Z_PARAM_LONG(facility)
 	ZEND_PARSE_PARAMETERS_END();
diff --git a/ext/standard/tests/network/openlog_null_bytes.phpt b/ext/standard/tests/network/openlog_null_bytes.phpt
new file mode 100644
index 000000000000..6d3274227815
--- /dev/null
+++ b/ext/standard/tests/network/openlog_null_bytes.phpt
@@ -0,0 +1,16 @@
+--TEST--
+openlog() rejects null bytes in prefix
+--SKIPIF--
+<?php
+if (!function_exists("openlog")) die("skip openlog() is not available");
+?>
+--FILE--
+<?php
+try {
+    openlog("foo\0bar", LOG_NDELAY, LOG_USER);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+openlog(): Argument #1 ($prefix) must not contain any null bytes