Repository navigation
fix(roles/php)!: disable session upload progress and fatal error backtraces - #467
Merged
Merged
Conversation
…traces Both are confirmed producers of CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, RCE via stale global state). Set session.upload_progress.enabled = Off for PHP 8.2 to 8.5 and fatal_error_backtraces = Off for PHP 8.5, in the ini and as php_admin_flag in every FPM pool. The ini alone does not hold: a .user.ini can re-enable the PERDIR upload progress, ini_set() the backtraces. Verified with php-fpm 8.5.11 on Rocky 10, with a control run without the flags.
Distribution PHP on EL8/EL9 and Ubuntu 22.04 is 7.2 to 8.1 and gets the CVE-2026-109619 fixes as vendor backports. Document the mod_php gaps (httpd restart, .htaccess overrides) in the README.
NavidSassan
force-pushed
the
fix/php-cve-2026-109619
branch
from
October 23, 2026 14:35
a23298e to
b6effeb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mitigates CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, RCE via stale global state) by default, following the recommendations of the PHP security team.
Changes
session.upload_progress.enabled = Offfor PHP 8.2 to 8.5 (php__ini_session_upload_progress_enabled__*_var, upstream defaultOn).fatal_error_backtraces = Offfor PHP 8.5 (php__ini_fatal_error_backtraces__*_var, upstream defaultOn).php_admin_flagin every PHP-FPM pool. The ini alone does not hold: a.user.inican re-enable the PERDIR upload progress,ini_set()the backtraces.php_admin_*marks the directiveZEND_INI_SYSTEM(sapi/fpm/fpm/fpm_php.c).Verification
php-fpm 8.5.11 (remi) on Rocky 10, with a control run without the flags:
php_admin_flagphp_admin_flag.user.iniwithsession.upload_progress.enabled = On1)0)ini_set('fatal_error_backtraces', '1')false, stays0extensions/molecule/php/install/verify.ymlasserts the CLI and both pools report upload progress off, against a.user.inithat tries to re-enable it. php-fpm only reads a.user.iniwithDOCUMENT_ROOTset (sapi/fpm/fpm/fpm_main.c), so the probe now sends it.molecule test --scenario-name php/installpassed on Debian 12 and 13 and Rocky 8, 9 and 10 (converge, verify, idempotence, verify).Not covered
memory_limit=-1, is a stop-gap and would remove the memory limit after the update as well.post_max_sizealready defaults to8M.