diff --git a/Dockerfile.template b/Dockerfile.template
index 220294b08f..42fa311430 100644
--- a/Dockerfile.template
+++ b/Dockerfile.template
@@ -166,6 +166,25 @@ RUN set -eux; \
 		echo 'ignore_repeated_source = Off'; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
+{{ if env.version != "cli" then ( -}}
+
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+{{ if env.phpVersion == "8.5" then ( -}}
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+{{ ) else "" end -}}
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+{{ ) else "" end -}}
 {{ if env.variant == "apache" then ( -}}
 
 RUN set -eux; \
diff --git a/beta/php8.2/apache/Dockerfile b/beta/php8.2/apache/Dockerfile
index a0c0a554b6..91e13b34bb 100644
--- a/beta/php8.2/apache/Dockerfile
+++ b/beta/php8.2/apache/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.2/fpm-alpine/Dockerfile b/beta/php8.2/fpm-alpine/Dockerfile
index 493922a4ab..c10c0ab543 100644
--- a/beta/php8.2/fpm-alpine/Dockerfile
+++ b/beta/php8.2/fpm-alpine/Dockerfile
@@ -103,6 +103,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.2/fpm/Dockerfile b/beta/php8.2/fpm/Dockerfile
index 5ac0c6d3bf..5aec96e048 100644
--- a/beta/php8.2/fpm/Dockerfile
+++ b/beta/php8.2/fpm/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.3/apache/Dockerfile b/beta/php8.3/apache/Dockerfile
index d24aeea03e..eec1868e2b 100644
--- a/beta/php8.3/apache/Dockerfile
+++ b/beta/php8.3/apache/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.3/fpm-alpine/Dockerfile b/beta/php8.3/fpm-alpine/Dockerfile
index 20f4429250..9960730bb1 100644
--- a/beta/php8.3/fpm-alpine/Dockerfile
+++ b/beta/php8.3/fpm-alpine/Dockerfile
@@ -103,6 +103,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.3/fpm/Dockerfile b/beta/php8.3/fpm/Dockerfile
index 0d000fa0dc..393a5f0b9b 100644
--- a/beta/php8.3/fpm/Dockerfile
+++ b/beta/php8.3/fpm/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.4/apache/Dockerfile b/beta/php8.4/apache/Dockerfile
index b684ce9296..b6ee6852b6 100644
--- a/beta/php8.4/apache/Dockerfile
+++ b/beta/php8.4/apache/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.4/fpm-alpine/Dockerfile b/beta/php8.4/fpm-alpine/Dockerfile
index aa0788f196..75c21e9b60 100644
--- a/beta/php8.4/fpm-alpine/Dockerfile
+++ b/beta/php8.4/fpm-alpine/Dockerfile
@@ -103,6 +103,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.4/fpm/Dockerfile b/beta/php8.4/fpm/Dockerfile
index f6f3a904d3..6d7aaa21dd 100644
--- a/beta/php8.4/fpm/Dockerfile
+++ b/beta/php8.4/fpm/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.5/apache/Dockerfile b/beta/php8.5/apache/Dockerfile
index 26fb3f7f2c..2871cd7c74 100644
--- a/beta/php8.5/apache/Dockerfile
+++ b/beta/php8.5/apache/Dockerfile
@@ -108,6 +108,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.5/fpm-alpine/Dockerfile b/beta/php8.5/fpm-alpine/Dockerfile
index 63a137e525..d79000616a 100644
--- a/beta/php8.5/fpm-alpine/Dockerfile
+++ b/beta/php8.5/fpm-alpine/Dockerfile
@@ -103,6 +103,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.5/fpm/Dockerfile b/beta/php8.5/fpm/Dockerfile
index 57ac73916c..f5f4cd7333 100644
--- a/beta/php8.5/fpm/Dockerfile
+++ b/beta/php8.5/fpm/Dockerfile
@@ -108,6 +108,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/latest/php8.2/apache/Dockerfile b/latest/php8.2/apache/Dockerfile
index 47b23d6e8b..2ac98ec726 100644
--- a/latest/php8.2/apache/Dockerfile
+++ b/latest/php8.2/apache/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.2/fpm-alpine/Dockerfile b/latest/php8.2/fpm-alpine/Dockerfile
index 4b50f07991..c35ecbe3a4 100644
--- a/latest/php8.2/fpm-alpine/Dockerfile
+++ b/latest/php8.2/fpm-alpine/Dockerfile
@@ -103,6 +103,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.2/fpm/Dockerfile b/latest/php8.2/fpm/Dockerfile
index 340f4ea6cb..5ebfecdd32 100644
--- a/latest/php8.2/fpm/Dockerfile
+++ b/latest/php8.2/fpm/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.3/apache/Dockerfile b/latest/php8.3/apache/Dockerfile
index 10581ef8de..d53447628e 100644
--- a/latest/php8.3/apache/Dockerfile
+++ b/latest/php8.3/apache/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.3/fpm-alpine/Dockerfile b/latest/php8.3/fpm-alpine/Dockerfile
index c9bebb17d9..b52e578532 100644
--- a/latest/php8.3/fpm-alpine/Dockerfile
+++ b/latest/php8.3/fpm-alpine/Dockerfile
@@ -103,6 +103,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.3/fpm/Dockerfile b/latest/php8.3/fpm/Dockerfile
index 975c8e8d60..89fb3c1105 100644
--- a/latest/php8.3/fpm/Dockerfile
+++ b/latest/php8.3/fpm/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.4/apache/Dockerfile b/latest/php8.4/apache/Dockerfile
index ecdadc2305..22a2a4c94a 100644
--- a/latest/php8.4/apache/Dockerfile
+++ b/latest/php8.4/apache/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.4/fpm-alpine/Dockerfile b/latest/php8.4/fpm-alpine/Dockerfile
index 4593777dd6..2e6da0b2dd 100644
--- a/latest/php8.4/fpm-alpine/Dockerfile
+++ b/latest/php8.4/fpm-alpine/Dockerfile
@@ -103,6 +103,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.4/fpm/Dockerfile b/latest/php8.4/fpm/Dockerfile
index b0e382b478..295f921ab5 100644
--- a/latest/php8.4/fpm/Dockerfile
+++ b/latest/php8.4/fpm/Dockerfile
@@ -108,6 +108,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.5/apache/Dockerfile b/latest/php8.5/apache/Dockerfile
index 94ee1f6ad1..0bd7394dc1 100644
--- a/latest/php8.5/apache/Dockerfile
+++ b/latest/php8.5/apache/Dockerfile
@@ -108,6 +108,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.5/fpm-alpine/Dockerfile b/latest/php8.5/fpm-alpine/Dockerfile
index 85c4652b71..4e47eeb722 100644
--- a/latest/php8.5/fpm-alpine/Dockerfile
+++ b/latest/php8.5/fpm-alpine/Dockerfile
@@ -103,6 +103,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.5/fpm/Dockerfile b/latest/php8.5/fpm/Dockerfile
index 3e824b4ae4..3e6123756a 100644
--- a/latest/php8.5/fpm/Dockerfile
+++ b/latest/php8.5/fpm/Dockerfile
@@ -108,6 +108,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \