From cca87c3a8d1d7f5ad4d002291f171b6115ff6a58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9o=20Unbekandt?= <leo@scalingo.com>
Date: Wed, 21 Oct 2026 12:11:10 +0200
Subject: [PATCH] security: Disable session upload-progress in php.ini

---
 conf/php/php-fpm.conf | 2 ++
 conf/php/php.ini      | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/conf/php/php-fpm.conf b/conf/php/php-fpm.conf
index 02d44744..084c7665 100644
--- a/conf/php/php-fpm.conf
+++ b/conf/php/php-fpm.conf
@@ -486,6 +486,8 @@ decorate_workers_output = no
 ;php_admin_flag[log_errors] = on
 ;php_admin_value[memory_limit] = 32M
 
+; CVE-2026-109618 / CVE-2026-109619
+php_admin_flag[session.upload_progress.enabled] = off
 
 ; Include one or more files. If glob(3) exists, it is used to include a bunch of
 ; files from a glob(3) pattern. This directive can be used everywhere in the
diff --git a/conf/php/php.ini b/conf/php/php.ini
index 28843693..4cf1c42e 100644
--- a/conf/php/php.ini
+++ b/conf/php/php.ini
@@ -24,3 +24,7 @@ opcache.enable_cli=1
 
 upload_max_filesize = 75M
 post_max_size = 75M
+
+; Session
+; CVE-2026-109618 / CVE-2026-109619
+session.upload_progress.enabled = Off