Update your PHP (if you can), folks. That is, install PHP 8.5.12 to fix critical vulnerabilities CVE-2026-109618 and CVE-2026-109619. https://www.php.net/archive/2026.php#2026-10-21-5 Until updates are available on your platform, I hear that setting in php.ini memory_limit=-1 session.upload_progress.enabled=0 fatal_error_backtraces=0 can mitigate some attacks. Also: Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length. More info from: Wiz Calif OpenAI Fastly claims to see evidence of exploitation ITW