From 3e3ff9b407ea14e6fa5af9d95a29978bc9ba81cc Mon Sep 17 00:00:00 2001
From: tmolick <thecoolreaver@gmail.com>
Date: Wed, 21 Oct 2026 11:07:58 -0700
Subject: [PATCH] Harden PHP config against PHP2Shell (CVE-2026-109619)

---
 .docker/app/php-overrides.ini | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.docker/app/php-overrides.ini b/.docker/app/php-overrides.ini
index 65f79775..d9323d41 100644
--- a/.docker/app/php-overrides.ini
+++ b/.docker/app/php-overrides.ini
@@ -1,8 +1,12 @@
 [PHP]
 expose_php = Off
 memory_limit = 64M
+; Defense in depth for CVE-2026-109619 (PHP2Shell); PHP 8.5.12+ is the real fix
+fatal_error_backtraces = 0
 
 [Session]
+; Defense in depth for CVE-2026-109619 (PHP2Shell); Laravel doesn't use native upload progress
+session.upload_progress.enabled = 0
 session.use_strict_mode = 1
 session.cookie_secure = 1
 session.name = danksid