From f5207c2e019aa958f15a2dbc56d091e9436b1f13 Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Fri, 23 Oct 2026 19:25:32 +0530 Subject: [PATCH] fix(php): turn off session upload progress by default Set session.upload_progress.enabled = Off in the php.ini of the 8.1 to 8.5 images. PHP's informational advisory for CVE-2026-115560 recommends keeping it off until the next regular release, and it was already the mitigation for CVE-2026-109618 and CVE-2026-109619. A site's php.ini comes from the image when the site is created, and on macOS the image's php.ini is used as is, so new sites get the safe default even without a custom.ini line. custom.ini is read after php.ini, so a site that needs upload progress can still set it to On there. --- php/8.1/php.ini | 2 ++ php/8.2/php.ini | 2 ++ php/8.3/php.ini | 2 ++ php/8.4/php.ini | 2 ++ php/8.5/php.ini | 2 ++ 5 files changed, 10 insertions(+) diff --git a/php/8.1/php.ini b/php/8.1/php.ini index 01513ab..2f37064 100644 --- a/php/8.1/php.ini +++ b/php/8.1/php.ini @@ -1527,6 +1527,8 @@ session.sid_bits_per_character = 5 ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On +; Off by default for security; a site's custom.ini can set it to On. +session.upload_progress.enabled = Off ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). diff --git a/php/8.2/php.ini b/php/8.2/php.ini index 01513ab..2f37064 100644 --- a/php/8.2/php.ini +++ b/php/8.2/php.ini @@ -1527,6 +1527,8 @@ session.sid_bits_per_character = 5 ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On +; Off by default for security; a site's custom.ini can set it to On. +session.upload_progress.enabled = Off ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). diff --git a/php/8.3/php.ini b/php/8.3/php.ini index 01513ab..2f37064 100644 --- a/php/8.3/php.ini +++ b/php/8.3/php.ini @@ -1527,6 +1527,8 @@ session.sid_bits_per_character = 5 ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On +; Off by default for security; a site's custom.ini can set it to On. +session.upload_progress.enabled = Off ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). diff --git a/php/8.4/php.ini b/php/8.4/php.ini index 01513ab..2f37064 100644 --- a/php/8.4/php.ini +++ b/php/8.4/php.ini @@ -1527,6 +1527,8 @@ session.sid_bits_per_character = 5 ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On +; Off by default for security; a site's custom.ini can set it to On. +session.upload_progress.enabled = Off ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). diff --git a/php/8.5/php.ini b/php/8.5/php.ini index 01513ab..2f37064 100644 --- a/php/8.5/php.ini +++ b/php/8.5/php.ini @@ -1527,6 +1527,8 @@ session.sid_bits_per_character = 5 ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On +; Off by default for security; a site's custom.ini can set it to On. +session.upload_progress.enabled = Off ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed).