Turn off fatal error backtraces (PHP 8.5)
This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.
What
fatal_error_backtraces = 0. Only on PHP 8.5. Older versions don't have this setting.
Why
On PHP 8.5 this is one confirmed way to reach CVE-2026-109619.
Watch out
Fatal errors won't show a backtrace, which makes debugging harder.
Set it by hand
| Your setup | Where | Add this |
|---|---|---|
| Any (php.ini) | php.ini, or a new file in its conf.d folder | fatal_error_backtraces = 0 |
| PHP-FPM | pool file, e.g. /etc/php/8.3/fpm/pool.d/www.conf | php_admin_flag[fatal_error_backtraces] = off |
| Apache mod_php | server or VirtualHost config | php_admin_flag fatal_error_backtraces off |
| Docker (official image) | your Dockerfile | RUN echo "fatal_error_backtraces = 0" >> /usr/local/etc/php/conf.d/99-php2shell.ini |
| Windows / XAMPP / IIS | php.ini in your PHP folder | fatal_error_backtraces = 0 |
| Shared hosting | Ask your provider. .user.ini and .htaccess are not reliable for this (why). | |
Then restart PHP. Nothing changes until you do.
Undo
Run php php2shell.php --undo and pick the change. Or remove the line by hand and restart PHP.
Source: php.net