diff --git a/CHANGELOG.md b/CHANGELOG.md
index ccdc36cd2..262b60191 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Breaking Changes
 
+* **role:php**: PHP no longer tracks file uploads in the session (`session.upload_progress.enabled = Off`), a confirmed way into the remote code execution CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)) that the advisory recommends closing even on patched PHP, and the PHP-FPM pools enforce this against `.user.ini` files. Upload progress bars that depend on it stop working. Set `php__ini_session_upload_progress_enabled__host_var: 'On'` to restore the feature.
 * **role:postgresql_server**: Databases are created with the `C.UTF-8` locale instead of `en_US.UTF-8`, which failed on hosts with only the minimal glibc language pack. `C.UTF-8` sorts text by code point instead of by language rules. Existing databases are unaffected. To create new databases as before, set `lc_collate: 'en_US.UTF-8'` and `lc_ctype: 'en_US.UTF-8'` on their entries in `postgresql_server__databases__*_var`.
 * **role:postgresql_server, playbook:setup_mastodon**: `postgresql_server__version` is mandatory, and PostgreSQL is only installed from the PostgreSQL Yum Repository instead of optionally from the distribution packages. Set the major version in your inventory, for example `postgresql_server__version: '18'`. On a host that already runs PostgreSQL from the distribution packages, the run aborts before it installs anything; move the data to the PostgreSQL Yum Repository release first, as described in the role README.
 * **role:postgresql_server**: `postgresql_server__pg_hba_entries` is replaced by `postgresql_server__pg_hba_local_entries__host_var` / `__group_var` for `local` records and `postgresql_server__pg_hba_host_entries__host_var` / `__group_var` for all `host*` records. Both are merged with the role defaults instead of replacing them, and an entry with `state: 'absent'` removes a default. Move your `local` entries to the first variable without their `type` key, and all other entries to the second, where `address` is mandatory. Entries from the inventory are written before the role defaults. The run aborts as long as the old variable is set.
@@ -275,6 +276,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+* **role:php**: PHP 8.5 logs fatal errors without a backtrace (`fatal_error_backtraces = Off`), which closes the main way into the remote code execution CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)) on unpatched builds. The role settings only narrow the attack paths: update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or your distribution's fixed package to close the vulnerability.
 * **role:apache_tomcat**: The host-manager webapp only accepts the clients that `apache_tomcat__webapps_manager_context_xml_allow` allows, as documented, instead of those that `apache_tomcat__webapps_docs_context_xml_allow` allows.
 * **role:borg_local, role:schedule_reboot, role:tools**: Neither the password of the Icinga API user nor the Rocket.Chat webhook of `schedule_reboot` shows up in the process list or in a file that every local user can read, which moves `schedule-icinga-downtime` from a shell function in `/etc/profile.d/alias.sh` to a command in `/usr/local/sbin` that only root may run.
 * **role:openvpn_server**: The server negotiates TLS 1.2 only with forward secrecy and checks client certificates against OpenSSL security level 2 ([#358](https://github.com/Linuxfabrik/lfops/issues/358)).
diff --git a/extensions/molecule/php/install/verify.yml b/extensions/molecule/php/install/verify.yml
index cace86fec..8f36eaaa9 100644
--- a/extensions/molecule/php/install/verify.yml
+++ b/extensions/molecule/php/install/verify.yml
@@ -301,6 +301,7 @@
           @ini_set('memory_limit', '1024M');
           echo 'memory_limit_after=' . ini_get('memory_limit') . "\n";
           echo 'session_save_path=' . ini_get('session.save_path') . "\n";
+          echo 'session_upload_progress_enabled=' . (int) ini_get('session.upload_progress.enabled') . "\n";
         dest: '/var/www/html/molecule-probe-{{ item }}.php'
         owner: 'root'
         group: 'root'
@@ -310,6 +311,19 @@
         - 'app1'
         - 'www'
 
+    # Session upload progress is a confirmed way into CVE-2026-109619 and the role switches it off.
+    # The directive is PERDIR, so the ini alone would not hold against a .user.ini that switches it
+    # back on; only the php_admin_flag in the pool does. This .user.ini is that attempt, and the
+    # probe below has to report the feature as off regardless.
+    - name: 'Deploy a .user.ini that tries to re-enable session upload progress'
+      ansible.builtin.copy:
+        content: "session.upload_progress.enabled = On\n"
+        dest: '/var/www/html/.user.ini'
+        owner: 'root'
+        group: 'root'
+        mode: 0o644
+        setype: '{{ "httpd_sys_content_t" if ansible_facts["os_family"] == "RedHat" else omit }}'
+
     # The status page reports the live process manager, which differs per pool (www: the dynamic
     # default, app1: the static override). Both pools serve it on the same path, so a wrong answer
     # here means the socket reached the wrong pool or the override never arrived.
@@ -335,9 +349,12 @@
           - '__molecule__pool_status_result["results"][1]["stdout"] is search("process manager:\s+dynamic")'
         fail_msg: 'status pages: {{ __molecule__pool_status_result["results"] | map(attribute="stdout") | list }}'
 
+    # DOCUMENT_ROOT as a web server would send it: php-fpm only reads a .user.ini when it is set
+    # (sapi/fpm/fpm/fpm_main.c), so without it the .user.ini above would never be tried.
     - name: 'Run the probe script through each pool socket'
       ansible.builtin.command: 'cgi-fcgi -bind -connect {{ __molecule__runtime_path }}/{{ item }}.sock'
       environment:
+        DOCUMENT_ROOT: '/var/www/html'
         QUERY_STRING: ''
         REQUEST_METHOD: 'GET'
         SCRIPT_FILENAME: '/var/www/html/molecule-probe-{{ item }}.php'
@@ -359,11 +376,24 @@
           - '__molecule__app1 is search("session_save_path=" ~ __molecule__session_path ~ "/app1")'
           - '"memory_limit=256M" in __molecule__www'
           - '__molecule__www is search("session_save_path=" ~ __molecule__session_path ~ "/www")'
+          - '"session_upload_progress_enabled=0" in __molecule__app1'
+          - '"session_upload_progress_enabled=0" in __molecule__www'
         fail_msg: 'app1: {{ __molecule__app1 }} www: {{ __molecule__www }}'
       vars:
         __molecule__app1: '{{ __molecule__pool_probe_result["results"][0]["stdout"] }}'
         __molecule__www: '{{ __molecule__pool_probe_result["results"][1]["stdout"] }}'
 
+    # The CLI reads the ini only, without a pool, so this proves the z00-linuxfabrik.ini itself.
+    - name: 'Read session.upload_progress.enabled from the CLI'
+      ansible.builtin.command: 'php --run "echo (int) ini_get(''session.upload_progress.enabled'');"'
+      register: '__molecule__php_upload_progress_result'
+      changed_when: false
+
+    - name: 'Assert session upload progress is off for the CLI'
+      ansible.builtin.assert:
+        that: '__molecule__php_upload_progress_result["stdout"] == "0"'
+        fail_msg: 'session.upload_progress.enabled is {{ __molecule__php_upload_progress_result["stdout"] }}, expected 0'
+
     - name: 'stat the per-pool session and WSDL cache directories'
       ansible.builtin.stat:
         path: '{{ item }}'
diff --git a/roles/php/README.md b/roles/php/README.md
index e0c44f4b6..d145fa742 100644
--- a/roles/php/README.md
+++ b/roles/php/README.md
@@ -207,6 +207,15 @@ Variables for `php.ini` directives and their default values, defined and support
 * Type: String.
 * Default: `'E_ALL & ~E_NOTICE & ~E_DEPRECATED'`
 
+`php__ini_fatal_error_backtraces__group_var` / `php__ini_fatal_error_backtraces__host_var`
+
+* Whether fatal errors include a backtrace. Only deployed from PHP 8.5 on, since older versions do not know the directive. [php.net](https://www.php.net/manual/en/errorfunc.configuration.php)
+* The PHP-FPM pools also set it as `php_admin_flag[fatal_error_backtraces]`, so an application cannot switch it back on with `ini_set()`.
+* With mod_php the role only deploys the ini, and the handler restarts PHP-FPM only: restart Apache httpd yourself for the value to take effect. A `php_flag` or `php_value` in the Apache configuration or in a `.htaccess` file can switch it back on, since mod_php has no equivalent of the pool's `php_admin_flag` that this role could set.
+* Type: String.
+* Default: `'Off'`
+* Deviates from the upstream default `On`: on PHP 8.5 builds without the fix for the remote code execution CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)), the backtrace a fatal error stores is the confirmed way into it. Patched builds are not affected by this; the role keeps the backtraces off as defense in depth, since production hosts log fatal errors without them. Only updating PHP fixes the vulnerability.
+
 `php__ini_max_execution_time__group_var` / `php__ini_max_execution_time__host_var`
 
 * This sets the maximum time in seconds a script is allowed to run before it is terminated by the parser. This helps prevent poorly written scripts from tying up the server. The default setting is 30. When running PHP from the command line the default setting is 0. [php.net](https://www.php.net/manual/en/info.configuration.php)
@@ -354,6 +363,15 @@ Variables for `php.ini` directives and their default values, defined and support
 * Type: String.
 * Default: `'a=href,area=href,frame=src,input=src,form=fakeentry'`
 
+`php__ini_session_upload_progress_enabled__group_var` / `php__ini_session_upload_progress_enabled__host_var`
+
+* Whether PHP records the progress of file uploads in the session, for upload progress bars. [php.net](https://www.php.net/manual/en/session.configuration.php)
+* The PHP-FPM pools also set it as `php_admin_flag[session.upload_progress.enabled]`, so a `.user.ini` cannot switch it back on.
+* With mod_php the role only deploys the ini, and the handler restarts PHP-FPM only: restart Apache httpd yourself for the value to take effect. A `php_flag` or `php_value` in the Apache configuration or in a `.htaccess` file can switch it back on, since mod_php has no equivalent of the pool's `php_admin_flag` that this role could set.
+* Type: String.
+* Default: `'Off'`
+* Deviates from the upstream default `On`: the feature is a confirmed way into the remote code execution CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)) on mod_php and PHP-FPM. The advisory considers keeping it off prudent even on patched versions where the feature is not needed, since it is hardly used and hardly tested.
+
 `php__ini_smtp__group_var` / `php__ini_smtp__host_var`
 
 * Host used by the `mail()` function to send mail (Windows only; ignored on Unix, where the `sendmail_path` binary is used). [php.net](https://www.php.net/manual/en/mail.configuration.php)
@@ -377,6 +395,7 @@ php__ini_default_socket_timeout__host_var: 10
 php__ini_display_errors__host_var: 'Off'
 php__ini_display_startup_errors__host_var: 'Off'
 php__ini_error_reporting__host_var: 'E_ALL & ~E_NOTICE & ~E_DEPRECATED'
+php__ini_fatal_error_backtraces__host_var: 'Off'
 php__ini_max_execution_time__host_var: 3600
 php__ini_max_file_uploads__host_var: 100
 php__ini_max_input_time__host_var: -1
@@ -399,6 +418,7 @@ php__ini_session_cookie_secure__host_var: 'On'
 php__ini_session_gc_maxlifetime__host_var: 1440
 php__ini_session_sid_length__host_var: 32
 php__ini_session_trans_sid_tags__host_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__host_var: 'Off'
 php__ini_smtp__host_var: 'localhost'
 php__ini_upload_max_filesize__host_var: '10000M'
 ```
diff --git a/roles/php/defaults/main.yml b/roles/php/defaults/main.yml
index 76ae67615..79369d9f7 100644
--- a/roles/php/defaults/main.yml
+++ b/roles/php/defaults/main.yml
@@ -181,6 +181,17 @@ php__ini_error_reporting__dependent_var: ''
 php__ini_error_reporting__group_var: ''
 php__ini_error_reporting__host_var: ''
 php__ini_error_reporting__role_var: ''
+php__ini_fatal_error_backtraces__combined_var: '{{
+    php__ini_fatal_error_backtraces__host_var if (php__ini_fatal_error_backtraces__host_var | string | length) else
+    php__ini_fatal_error_backtraces__group_var if (php__ini_fatal_error_backtraces__group_var | string | length) else
+    php__ini_fatal_error_backtraces__dependent_var if (php__ini_fatal_error_backtraces__dependent_var | string | length) else
+    php__ini_fatal_error_backtraces__role_var
+  }}'
+
+php__ini_fatal_error_backtraces__dependent_var: ''
+php__ini_fatal_error_backtraces__group_var: ''
+php__ini_fatal_error_backtraces__host_var: ''
+php__ini_fatal_error_backtraces__role_var: ''
 php__ini_max_execution_time__combined_var: '{{
     php__ini_max_execution_time__host_var if (php__ini_max_execution_time__host_var | string | length) else
     php__ini_max_execution_time__group_var if (php__ini_max_execution_time__group_var | string | length) else
@@ -423,6 +434,17 @@ php__ini_session_trans_sid_tags__dependent_var: ''
 php__ini_session_trans_sid_tags__group_var: ''
 php__ini_session_trans_sid_tags__host_var: ''
 php__ini_session_trans_sid_tags__role_var: ''
+php__ini_session_upload_progress_enabled__combined_var: '{{
+    php__ini_session_upload_progress_enabled__host_var if (php__ini_session_upload_progress_enabled__host_var | string | length) else
+    php__ini_session_upload_progress_enabled__group_var if (php__ini_session_upload_progress_enabled__group_var | string | length) else
+    php__ini_session_upload_progress_enabled__dependent_var if (php__ini_session_upload_progress_enabled__dependent_var | string | length) else
+    php__ini_session_upload_progress_enabled__role_var
+  }}'
+
+php__ini_session_upload_progress_enabled__dependent_var: ''
+php__ini_session_upload_progress_enabled__group_var: ''
+php__ini_session_upload_progress_enabled__host_var: ''
+php__ini_session_upload_progress_enabled__role_var: ''
 php__ini_smtp__combined_var: '{{
     php__ini_smtp__host_var if (php__ini_smtp__host_var | string | length) else
     php__ini_smtp__group_var if (php__ini_smtp__group_var | string | length) else
diff --git a/roles/php/meta/argument_specs.yml b/roles/php/meta/argument_specs.yml
index e1de094e4..724319c22 100644
--- a/roles/php/meta/argument_specs.yml
+++ b/roles/php/meta/argument_specs.yml
@@ -316,6 +316,24 @@ argument_specs:
         default: ''
         description: 'The error reporting level. Host-level override.'
 
+      php__ini_fatal_error_backtraces__dependent_var:
+        type: 'str'
+        required: false
+        default: ''
+        description: 'Whether fatal errors include a backtrace (PHP 8.5+). Dependent-role injection.'
+
+      php__ini_fatal_error_backtraces__group_var:
+        type: 'str'
+        required: false
+        default: ''
+        description: 'Whether fatal errors include a backtrace (PHP 8.5+). Group-level override.'
+
+      php__ini_fatal_error_backtraces__host_var:
+        type: 'str'
+        required: false
+        default: ''
+        description: 'Whether fatal errors include a backtrace (PHP 8.5+). Host-level override.'
+
       php__ini_max_execution_time__dependent_var:
         type: 'raw'
         required: false
@@ -715,6 +733,24 @@ argument_specs:
         default: ''
         description: 'HTML tags rewritten to include the session ID. Host-level override.'
 
+      php__ini_session_upload_progress_enabled__dependent_var:
+        type: 'str'
+        required: false
+        default: ''
+        description: 'Whether PHP tracks the upload progress of files in the session. Dependent-role injection.'
+
+      php__ini_session_upload_progress_enabled__group_var:
+        type: 'str'
+        required: false
+        default: ''
+        description: 'Whether PHP tracks the upload progress of files in the session. Group-level override.'
+
+      php__ini_session_upload_progress_enabled__host_var:
+        type: 'str'
+        required: false
+        default: ''
+        description: 'Whether PHP tracks the upload progress of files in the session. Host-level override.'
+
       php__ini_smtp__dependent_var:
         type: 'str'
         required: false
diff --git a/roles/php/templates/etc/php-fpm.d/pool.conf.j2 b/roles/php/templates/etc/php-fpm.d/pool.conf.j2
index 523b32cb5..b467d97e3 100644
--- a/roles/php/templates/etc/php-fpm.d/pool.conf.j2
+++ b/roles/php/templates/etc/php-fpm.d/pool.conf.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 {% if item['by_role'] | d() %}
 ; Generated by Ansible role: {{ item['by_role'] }}
 {% endif %}
@@ -543,6 +543,20 @@ php_admin_value[open_basedir] = {{ item['php_admin_value_open_basedir'] }}
 {% endif %}
 php_admin_value[post_max_size] = {{ item['php_admin_value_post_max_size'] | d(php__ini_post_max_size__combined_var) }}
 php_admin_value[upload_max_filesize] = {{ item['php_admin_value_upload_max_filesize'] | d(php__ini_upload_max_filesize__combined_var) }}
+{#
+  Repeated from the ini as php_admin_flag, because the ini alone does not hold: a .user.ini can
+  re-enable session.upload_progress.enabled (PERDIR), and ini_set() can re-enable
+  fatal_error_backtraces (ALL). Both are producers of CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), and
+  php_admin_* is applied at worker start, before any request is parsed, and marks the directive
+  ZEND_INI_SYSTEM (sapi/fpm/fpm/fpm_php.c), so neither a .user.ini nor ini_set() can change it.
+  Verified with php-fpm 8.5.11 on Rocky 10: without the flags a .user.ini re-enables upload
+  progress and ini_set() re-enables the backtraces, with them both stay off.
+  fatal_error_backtraces only exists from PHP 8.5 on.
+#}
+{% if __php__installed_version is version('8.5', '>=') %}
+php_admin_flag[fatal_error_backtraces] = {{ php__ini_fatal_error_backtraces__combined_var }}
+{% endif %}
+php_admin_flag[session.upload_progress.enabled] = {{ php__ini_session_upload_progress_enabled__combined_var }}
 
 ; Set the following data paths to directories owned by the FPM process user.
 ;
diff --git a/roles/php/templates/etc/php.d/7.2-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/7.2-z00-linuxfabrik.ini.j2
index 05d122d59..d6784b818 100644
--- a/roles/php/templates/etc/php.d/7.2-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/7.2-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2024062001
+; 2026102101
 ; php 7.2
 
 [PHP]
@@ -43,3 +43,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/7.3-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/7.3-z00-linuxfabrik.ini.j2
index 8e8eac57b..218c41b94 100644
--- a/roles/php/templates/etc/php.d/7.3-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/7.3-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 7.3
 
 [PHP]
@@ -46,3 +46,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/7.4-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/7.4-z00-linuxfabrik.ini.j2
index 6e5b31bcc..0df2467f9 100644
--- a/roles/php/templates/etc/php.d/7.4-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/7.4-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 7.4
 
 [PHP]
@@ -46,3 +46,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/8.0-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/8.0-z00-linuxfabrik.ini.j2
index 97cce38fd..31c905e34 100644
--- a/roles/php/templates/etc/php.d/8.0-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/8.0-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 8.0
 
 [PHP]
@@ -46,3 +46,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/8.1-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/8.1-z00-linuxfabrik.ini.j2
index fb5635626..1eba503f1 100644
--- a/roles/php/templates/etc/php.d/8.1-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/8.1-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 8.1
 
 [PHP]
@@ -46,3 +46,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/8.2-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/8.2-z00-linuxfabrik.ini.j2
index e4cdfca37..40d88b5be 100644
--- a/roles/php/templates/etc/php.d/8.2-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/8.2-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 8.2
 
 [PHP]
@@ -46,3 +46,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/8.3-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/8.3-z00-linuxfabrik.ini.j2
index 758fa3cf1..f35b62f70 100644
--- a/roles/php/templates/etc/php.d/8.3-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/8.3-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 8.3
 
 [PHP]
@@ -46,3 +46,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/8.4-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/8.4-z00-linuxfabrik.ini.j2
index f112c6b8a..07f8e1e06 100644
--- a/roles/php/templates/etc/php.d/8.4-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/8.4-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 8.4
 
 [PHP]
@@ -46,3 +46,4 @@ session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.sid_length = {{ php__ini_session_sid_length__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/templates/etc/php.d/8.5-z00-linuxfabrik.ini.j2 b/roles/php/templates/etc/php.d/8.5-z00-linuxfabrik.ini.j2
index 00f489c3e..ff7eefbe8 100644
--- a/roles/php/templates/etc/php.d/8.5-z00-linuxfabrik.ini.j2
+++ b/roles/php/templates/etc/php.d/8.5-z00-linuxfabrik.ini.j2
@@ -1,5 +1,5 @@
 ; {{ ansible_managed }}
-; 2026090801
+; 2026102101
 ; php 8.5
 
 [PHP]
@@ -9,6 +9,7 @@ display_errors = {{ php__ini_display_errors__combined_var }}
 display_startup_errors = {{ php__ini_display_startup_errors__combined_var }}
 error_reporting = {{ php__ini_error_reporting__combined_var }}
 expose_php = Off  ; differs from default on purpose due to security reasons
+fatal_error_backtraces = {{ php__ini_fatal_error_backtraces__combined_var }}
 html_errors = Off  ; differs from default on purpose due to security reasons
 max_execution_time = {{ php__ini_max_execution_time__combined_var }}
 max_file_uploads = {{ php__ini_max_file_uploads__combined_var }}
@@ -45,3 +46,4 @@ session.cookie_samesite = "{{ php__ini_session_cookie_samesite__combined_var }}"
 session.cookie_secure = {{ php__ini_session_cookie_secure__combined_var }}
 session.gc_maxlifetime = {{ php__ini_session_gc_maxlifetime__combined_var }}
 session.trans_sid_tags = "{{ php__ini_session_trans_sid_tags__combined_var }}"
+session.upload_progress.enabled = {{ php__ini_session_upload_progress_enabled__combined_var }}
diff --git a/roles/php/vars/7.2.yml b/roles/php/vars/7.2.yml
index 34ec30517..469fb69a4 100644
--- a/roles/php/vars/7.2.yml
+++ b/roles/php/vars/7.2.yml
@@ -25,5 +25,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/7.3.yml b/roles/php/vars/7.3.yml
index 7f2a885a0..77f3b4cd4 100644
--- a/roles/php/vars/7.3.yml
+++ b/roles/php/vars/7.3.yml
@@ -26,5 +26,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/7.4.yml b/roles/php/vars/7.4.yml
index 7f2a885a0..77f3b4cd4 100644
--- a/roles/php/vars/7.4.yml
+++ b/roles/php/vars/7.4.yml
@@ -26,5 +26,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/8.0.yml b/roles/php/vars/8.0.yml
index 7f2a885a0..77f3b4cd4 100644
--- a/roles/php/vars/8.0.yml
+++ b/roles/php/vars/8.0.yml
@@ -26,5 +26,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/8.1.yml b/roles/php/vars/8.1.yml
index 7f2a885a0..77f3b4cd4 100644
--- a/roles/php/vars/8.1.yml
+++ b/roles/php/vars/8.1.yml
@@ -26,5 +26,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/8.2.yml b/roles/php/vars/8.2.yml
index 7f2a885a0..77f3b4cd4 100644
--- a/roles/php/vars/8.2.yml
+++ b/roles/php/vars/8.2.yml
@@ -26,5 +26,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/8.3.yml b/roles/php/vars/8.3.yml
index 7f2a885a0..77f3b4cd4 100644
--- a/roles/php/vars/8.3.yml
+++ b/roles/php/vars/8.3.yml
@@ -26,5 +26,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/8.4.yml b/roles/php/vars/8.4.yml
index 7f2a885a0..77f3b4cd4 100644
--- a/roles/php/vars/8.4.yml
+++ b/roles/php/vars/8.4.yml
@@ -26,5 +26,6 @@ php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_sid_length__role_var: 32
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'
diff --git a/roles/php/vars/8.5.yml b/roles/php/vars/8.5.yml
index 51967a780..c9751b909 100644
--- a/roles/php/vars/8.5.yml
+++ b/roles/php/vars/8.5.yml
@@ -4,6 +4,7 @@ php__ini_default_socket_timeout__role_var: 10
 php__ini_display_errors__role_var: 'Off'
 php__ini_display_startup_errors__role_var: 'Off'
 php__ini_error_reporting__role_var: 'E_ALL & ~E_NOTICE & ~E_DEPRECATED'  # E_STRICT is unused and has been deprecated as of PHP 8.4.0.
+php__ini_fatal_error_backtraces__role_var: 'Off'  # upstream default: On
 php__ini_max_execution_time__role_var: 30
 php__ini_max_file_uploads__role_var: 50
 php__ini_max_input_time__role_var: -1
@@ -25,5 +26,6 @@ php__ini_session_cookie_samesite__role_var: 'Lax'  # upstream default: '' (no at
 php__ini_session_cookie_secure__role_var: 'On'  # upstream default: Off
 php__ini_session_gc_maxlifetime__role_var: 1440
 php__ini_session_trans_sid_tags__role_var: 'a=href,area=href,frame=src,input=src,form=fakeentry'
+php__ini_session_upload_progress_enabled__role_var: 'Off'  # upstream default: On
 php__ini_smtp__role_var: 'localhost'
 php__ini_upload_max_filesize__role_var: '2M'