2026-10-21 19:10 UTC
Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?
; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M
; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0
Replies (4)
-
@NuclearOatmeal@beige.party 2026-10-21 19:17
@jwz@mastodon.social You have a duped php_admin_value[post_max_size]. You have upload_max_filesize being smaller than post_max_size if you use the 32M, so that all should be good to go with what you have.
-
@corycarson@social.seattle.wa.us 2026-10-21 19:22
@jwz@mastodon.social No - per php dev https://phpc.social/@Girgias/117476477429221001
-
@jwz@mastodon.social 2026-10-21 23:25
Compiling php from scratch for the 10th time today so far, completely normal experience in a completely normal world
-
@skippy@social.lol 2026-10-21 19:16
@jwz@mastodon.social can't confirm or deny, but I am seeing people also recommend to block multi-part uploads to your PHP scripts at your web server. https://github.com/PasqualePillitteri/php2shell-hardening/