As reported here on Secunia (as discovered by shinnai), there's a code execution vulnerability in PHP's glob function:

The vulnerability is caused due to an error in the handling of an uninitialized structure inside the "glob()" function. This can be exploited to execute arbitrary code, which may lead to security restrictions (e.g. the "disable_functions" directive) being bypassed.

The vulnerability is confirmed in the 5.2.3 win32 installer. Other versions may also be affected.

The issue is marked as "less critical" and can be avoided easily by only allowing trusted users the correct permissions to execute PHP code on the server.

Pierre-Alain Joye has posted about some long-awaited features that he's added to his zip PECL package:

After a relatively long period without features addition, I feel like it is time to add some long awaited features to zip.

The features added are:

• Glob and pattern support - now possible to add files using a glob pattern syntax or regexp (pcre based)
• getStatusString - returns the error message containing the system/zlib or zip error, handy while debugging

These features are still just in the alpha release, but he's included some code to help you become familiar with their functionality already - one using glob, the other the regular expression.