diff --git a/Dockerfile b/Dockerfile
index 67a5aaf..dac8e5a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -43,6 +43,8 @@ COPY etc/configs/nginx/default.conf /etc/nginx/sites-available/default
 COPY etc/configs/nginx/snippets/fastcgi-php.conf /etc/nginx/snippets/fastcgi-php"${PHP_VERSION}".conf
 COPY etc/configs/php/php-fpm.conf /etc/php/"${PHP_VERSION}"/fpm/php-fpm.conf
 COPY etc/configs/php/www.conf /etc/php/"${PHP_VERSION}"/fpm/pool.d/www.conf
+COPY etc/configs/php/conf.d/99-php2shell-mitigation.ini /etc/php/"${PHP_VERSION}"/fpm/conf.d/99-php2shell-mitigation.ini
+COPY etc/configs/php/conf.d/99-php2shell-mitigation.ini /etc/php/"${PHP_VERSION}"/cli/conf.d/99-php2shell-mitigation.ini
 
 # Update default.conf with PHP socket and configure PHP-FPM with custom settings
 RUN sed -i "s|\${PHP_VERSION}|${PHP_VERSION}|g" /etc/nginx/snippets/fastcgi-php"${PHP_VERSION}".conf && \
diff --git a/etc/configs/php/conf.d/99-php2shell-mitigation.ini b/etc/configs/php/conf.d/99-php2shell-mitigation.ini
new file mode 100644
index 0000000..32ef5a8
--- /dev/null
+++ b/etc/configs/php/conf.d/99-php2shell-mitigation.ini
@@ -0,0 +1,5 @@
+; Interim mitigations for CVE-2026-109618 / CVE-2026-109619; remove once PHP is patched
+; GHSA-w8hw-w9fx-j79w: memory_limit=-1 removes the predictable per-request limit the confirmed exploit needs
+memory_limit = -1
+; GHSA-6wmf-4rv5-p3rp: closes the session upload progress producer path
+session.upload_progress.enabled = 0