diff --git a/release/16.2.1+35.0.2-fpm b/release/16.2.1+35.0.2-fpm
new file mode 100644
index 0000000..4780567
--- /dev/null
+++ b/release/16.2.1+35.0.2-fpm
@@ -0,0 +1,12 @@
+Interim mitigations for the critical PHP RCE vulnerabilities CVE-2026-109618
+and CVE-2026-109619 (https://www.php.net/archive/2026.php#2026-10-21-5).
+The nextcloud:35.0.2-fpm image still ships PHP 8.5.11; a patched image is not
+yet available. Upgrade as soon as one with PHP >= 8.5.12 is released.
+
+Added to the PHP-FPM pool (fpm-tune.ini, FPM_TUNE_VERSION v6):
+
+- memory_limit = -1 (PHP_MEMORY_LIMIT is ignored for web requests)
+- post_max_size = 32M, upload_max_filesize = 30M (PHP_UPLOAD_LIMIT is ignored
+  for web requests). WebDAV/chunked uploads use PUT and are not affected.
+- session.upload_progress.enabled = off
+- fatal_error_backtraces = off