diff --git a/.docker/app/php-overrides.ini b/.docker/app/php-overrides.ini
index 65f79775..d9323d41 100644
--- a/.docker/app/php-overrides.ini
+++ b/.docker/app/php-overrides.ini
@@ -1,8 +1,12 @@
 [PHP]
 expose_php = Off
 memory_limit = 64M
+; Defense in depth for CVE-2026-109619 (PHP2Shell); PHP 8.5.12+ is the real fix
+fatal_error_backtraces = 0
 
 [Session]
+; Defense in depth for CVE-2026-109619 (PHP2Shell); Laravel doesn't use native upload progress
+session.upload_progress.enabled = 0
 session.use_strict_mode = 1
 session.cookie_secure = 1
 session.name = danksid