diff --git a/phpstan.neon.dist b/phpstan.neon.dist
index 655bb9bbc807c..1d23fc757f9f2 100644
--- a/phpstan.neon.dist
+++ b/phpstan.neon.dist
@@ -25,7 +25,6 @@ includes:
 	- tests/phpstan/baselines/argument.type.neon
 	- tests/phpstan/baselines/argument.unresolvableType.neon
 	- tests/phpstan/baselines/assign.propertyType.neon
-	- tests/phpstan/baselines/binaryOp.invalid.neon
 	- tests/phpstan/baselines/booleanAnd.alwaysFalse.neon
 	- tests/phpstan/baselines/booleanAnd.leftAlwaysTrue.neon
 	- tests/phpstan/baselines/booleanNot.alwaysTrue.neon
diff --git a/src/wp-content/themes/twentytwenty/functions.php b/src/wp-content/themes/twentytwenty/functions.php
index b92ff1a1bd2b7..222330d11292a 100644
--- a/src/wp-content/themes/twentytwenty/functions.php
+++ b/src/wp-content/themes/twentytwenty/functions.php
@@ -321,8 +321,8 @@ function twentytwenty_get_custom_logo( $html ) {
 
 	if ( $logo ) {
 		// For clarity.
-		$logo_width  = esc_attr( $logo[1] );
-		$logo_height = esc_attr( $logo[2] );
+		$logo_width  = absint( $logo[1] );
+		$logo_height = absint( $logo[2] );
 
 		// If the retina logo setting is active, reduce the width/height by half.
 		if ( get_theme_mod( 'retina_logo', false ) ) {
diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php
index b6847266eb162..8afeee7441387 100644
--- a/src/wp-includes/comment.php
+++ b/src/wp-includes/comment.php
@@ -1214,8 +1214,8 @@ function get_page_of_comment( $comment_id, $args = array() ) {
 		 *                                      (trackbacks and pingbacks), or 'all'. Default 'all'.
 		 *     @type int    $post_id            ID of the post.
 		 *     @type string $fields             Comment fields to return.
-		 *     @type bool   $count              Whether to return a comment count (true) or array
-		 *                                      of comment objects (false).
+		 *     @type true   $count              Required. Whether to return a comment count. Must be
+		 *                                      true, because the page number is calculated from it.
 		 *     @type string $status             Comment status.
 		 *     @type int    $parent             Parent ID of comment to retrieve children of.
 		 *     @type array  $date_query         Date query clauses to limit comments by. See WP_Date_Query.
diff --git a/src/wp-includes/user.php b/src/wp-includes/user.php
index 02a412b291a8e..3d49059cecf0f 100644
--- a/src/wp-includes/user.php
+++ b/src/wp-includes/user.php
@@ -3236,7 +3236,7 @@ function check_password_reset_key(
 
 	if ( str_contains( $user->user_activation_key, ':' ) ) {
 		list( $pass_request_time, $pass_key ) = explode( ':', $user->user_activation_key, 2 );
-		$expiration_time                      = $pass_request_time + $expiration_duration;
+		$expiration_time                      = (int) $pass_request_time + $expiration_duration;
 	} else {
 		$pass_key        = $user->user_activation_key;
 		$expiration_time = false;
diff --git a/tests/phpstan/baselines/binaryOp.invalid.neon b/tests/phpstan/baselines/binaryOp.invalid.neon
deleted file mode 100644
index 167f159cffb34..0000000000000
--- a/tests/phpstan/baselines/binaryOp.invalid.neon
+++ /dev/null
@@ -1,35 +0,0 @@
-# PHPStan baseline for the `binaryOp.invalid` errors in WordPress core.
-#
-# https://phpstan.org/error-identifiers/binaryOp.invalid
-#
-# Each entry is scoped to a single file and carries an exact occurrence count,
-# so that a new instance is reported as a new error rather than being absorbed
-# silently. Fixing an occurrence therefore means decrementing or removing its
-# entry here as part of the same change.
-#
-# The goal is to empty this file and delete it, along with the `includes` entry
-# for it in phpstan.neon.dist.
-#
-# Generated by `composer phpstan:baselines`. Do not edit by hand; regenerate with
-#
-#     composer phpstan:baselines -- --identifier=binaryOp.invalid
-#
-# which reruns the analysis with this file suppressed so the errors surface again.
-
-parameters:
-	ignoreErrors:
-		-
-			message: '#^Binary operation "/" between string and 2 results in an error\.$#'
-			identifier: binaryOp.invalid
-			count: 2
-			path: ../../../src/wp-content/themes/twentytwenty/functions.php
-		-
-			message: '#^Binary operation "\+" between array\<int\<0, max\>\|WP_Comment\>\|int\<1, max\> and 1 results in an error\.$#'
-			identifier: binaryOp.invalid
-			count: 1
-			path: ../../../src/wp-includes/comment.php
-		-
-			message: '#^Binary operation "\+" between string and int results in an error\.$#'
-			identifier: binaryOp.invalid
-			count: 1
-			path: ../../../src/wp-includes/user.php
diff --git a/tests/phpunit/tests/auth.php b/tests/phpunit/tests/auth.php
index a419c93299a36..28de89c77864c 100644
--- a/tests/phpunit/tests/auth.php
+++ b/tests/phpunit/tests/auth.php
@@ -865,6 +865,30 @@ public function test_expired_user_activation_key_is_rejected() {
 		$this->assertSame( 'expired_key', $check->get_error_code() );
 	}
 
+	/**
+	 * @ticket 65817
+	 */
+	public function test_user_activation_key_with_non_numeric_timestamp_is_rejected() {
+		global $wpdb;
+
+		$key = wp_generate_password( 20, false );
+		$wpdb->update(
+			$wpdb->users,
+			array(
+				'user_activation_key' => 'not-a-timestamp:' . wp_fast_hash( $key ),
+			),
+			array(
+				'ID' => $this->user->ID,
+			)
+		);
+		clean_user_cache( $this->user );
+
+		// A key with a valid hash but a malformed timestamp should be rejected as expired.
+		$check = check_password_reset_key( $key, $this->user->user_login );
+		$this->assertWPError( $check );
+		$this->assertSame( 'expired_key', $check->get_error_code() );
+	}
+
 	/**
 	 * @ticket 32429
 	 */