Linus Gasser
0e2d8484ee
This includes the mitigations proposed by https://www.php.net/archive/2026.php#2026-10-21-5
15 lines
587 B
INI
15 lines
587 B
INI
[www]
|
|
pm = dynamic
|
|
pm.max_children = {{ env "FPM_MAX_CHILDREN" }}
|
|
pm.start_servers = {{ env "FPM_START_SERVERS" }}
|
|
pm.min_spare_servers = {{ env "FPM_MIN_SPARE_SERVERS" }}
|
|
pm.max_spare_servers = {{ env "FPM_MAX_SPARE_SERVERS" }}
|
|
|
|
; Mitigations for CVE-2026-109618 / CVE-2026-109619 until the image ships
|
|
; PHP >= 8.5.12, see https://www.php.net/archive/2026.php#2026-10-21-5
|
|
php_admin_value[memory_limit] = -1
|
|
php_admin_value[post_max_size] = 32M
|
|
php_admin_value[upload_max_filesize] = 30M
|
|
php_admin_value[session.upload_progress.enabled] = 0
|
|
php_admin_value[fatal_error_backtraces] = 0
|