[mrrobot47]

What

Set session.upload_progress.enabled = Off in the php.ini of the PHP 8.1, 8.2, 8.3, 8.4 and 8.5 images, right below the commented-out default in the [Session] upload-progress block.

Why

PHP's informational advisory of 2026-10-23 for CVE-2026-115560 (https://www.php.net/archive/2026.php#2026-10-23-1) asks to keep session upload progress off until the next regular bugfix release. It was already the recommended mitigation for CVE-2026-109618 and CVE-2026-109619, and it is the main protection on 8.1, which gets no fixed PHP release.

v4.13.3 turned it off through each site's custom.ini. The images still had PHP's default, On, so anything that brings back a custom.ini without the line, or never had it, ran with it On:

• a site's PHP config (/usr/local/etc) is copied from the image when the site is created, so new sites now get Off from php.ini as well as from custom.ini;
• on macOS the image's php.ini is used as is (the site's custom.ini is mounted outside the scanned conf.d there), so this is the first change that turns it off on macOS.

Existing sites keep their own copy of php.ini, so this doesn't change them. Restoring a backup taken before v4.13.3 also replaces php.ini and custom.ini with the backup's copies; EasyEngine/site-command#520 handles that case.

custom.ini is read after php.ini, so a site that needs upload progress can still set session.upload_progress.enabled = On there.

Scope

Only the images this workflow builds and publishes (8.1–8.5). php/5.6 to php/8.0 and php/stable aren't built by CI, so changing their php.ini wouldn't ship anywhere and couldn't be tested here; a future rebuild of 7.4/8.0 should carry the same line.

Testing

Each image was built from this branch on a fresh runner and compared with the published easyengine/php<version>:v4.13.3:

• php -i shows session.upload_progress.enabled => Off => Off (On on v4.13.3).
• In EasyEngine's Linux layout (a named volume on /usr/local/etc, populated from the image, plus a site custom.ini), the populated php.ini has the line, PHP-FPM reports it Off, and a custom.ini with session.upload_progress.enabled = On turns it back On, with upload_max_filesize from custom.ini still applied.
• ini_get_all() from the CLI and from PHP-FPM (with and without a custom.ini) differs from v4.13.3 only in session.upload_progress.enabled; with the custom.ini On, the FPM output is identical to v4.13.3.

Merges cleanly with #367, #372 and #373.

[Copilot]

🟢 Approval recommended

The five small configuration changes consistently implement the intended security default, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Disables session upload progress by default in EasyEngine’s PHP 8.1–8.5 images, extending the security mitigation to image-level configuration. Existing sites retain their own configuration.

Changes:

• Sets session.upload_progress.enabled = Off in all five published PHP image configurations.
• Adds a comment explaining the security default and the site-level custom.ini override.

File	Description
php/​8.5/​php.ini	Disables upload progress by default for PHP 8.5.
php/​8.4/​php.ini	Disables upload progress by default for PHP 8.4.
php/​8.3/​php.ini	Disables upload progress by default for PHP 8.3.
php/​8.2/​php.ini	Disables upload progress by default for PHP 8.2.
php/​8.1/​php.ini	Disables upload progress by default for PHP 8.1.

_{Review effort: Balanced}