Two things you can do now:
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
3. Disable PHP entirely on your server, and live with broken sites until the patch arrives.
That's what I did; I can live with my sites being down until it's possible to patch PHP. Though, there are likely others who cannot. The CERT-EU advisory is basically advising the same thing[1].
[1] https://cert.europa.eu/publications/security-advisories/2026...
Our current plan is to refactor this into Rust using a coding agent. It looks feasible to get this done today.