diff --git a/abra.sh b/abra.sh
index d68a372..ce12ad3 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-export FPM_TUNE_VERSION=v5
+export FPM_TUNE_VERSION=v6
 export NGINX_CONF_VERSION=v9
 export MY_CNF_VERSION=v6
 export ENTRYPOINT_VERSION=v3
diff --git a/fpm-tune.ini b/fpm-tune.ini
index af0f58d..bbebff6 100644
--- a/fpm-tune.ini
+++ b/fpm-tune.ini
@@ -1,5 +1,14 @@
+[www]
 pm = dynamic
 pm.max_children = {{ env "FPM_MAX_CHILDREN" }}
 pm.start_servers = {{ env "FPM_START_SERVERS" }}
 pm.min_spare_servers = {{ env "FPM_MIN_SPARE_SERVERS" }}
 pm.max_spare_servers = {{ env "FPM_MAX_SPARE_SERVERS" }}
+
+; Mitigations for CVE-2026-109618 / CVE-2026-109619 until the image ships
+; PHP >= 8.5.12, see https://www.php.net/archive/2026.php#2026-10-21-5
+php_admin_value[memory_limit] = -1
+php_admin_value[post_max_size] = 32M
+php_admin_value[upload_max_filesize] = 30M
+php_admin_value[session.upload_progress.enabled] = 0
+php_admin_value[fatal_error_backtraces] = 0
diff --git a/release/next b/release/next
new file mode 100644
index 0000000..4abd4a7
--- /dev/null
+++ b/release/next
@@ -0,0 +1,4 @@
+Security: mitigates PHP RCE CVE-2026-109618 / CVE-2026-109619 (https://www.php.net/archive/2026.php#2026-10-21-5)
+via the FPM pool config: memory_limit=-1, post_max_size=32M, upload_max_filesize=30M,
+session.upload_progress.enabled=0, fatal_error_backtraces=0. PHP_MEMORY_LIMIT and PHP_UPLOAD_LIMIT
+are overridden for web requests until the nextcloud image ships PHP >= 8.5.12.