diff --git a/conf/php/php-fpm.conf b/conf/php/php-fpm.conf
index 02d44744..084c7665 100644
--- a/conf/php/php-fpm.conf
+++ b/conf/php/php-fpm.conf
@@ -486,6 +486,8 @@ decorate_workers_output = no
 ;php_admin_flag[log_errors] = on
 ;php_admin_value[memory_limit] = 32M
 
+; CVE-2026-109618 / CVE-2026-109619
+php_admin_flag[session.upload_progress.enabled] = off
 
 ; Include one or more files. If glob(3) exists, it is used to include a bunch of
 ; files from a glob(3) pattern. This directive can be used everywhere in the
diff --git a/conf/php/php.ini b/conf/php/php.ini
index 28843693..4cf1c42e 100644
--- a/conf/php/php.ini
+++ b/conf/php/php.ini
@@ -24,3 +24,7 @@ opcache.enable_cli=1
 
 upload_max_filesize = 75M
 post_max_size = 75M
+
+; Session
+; CVE-2026-109618 / CVE-2026-109619
+session.upload_progress.enabled = Off