Settings in your project that undo the fixes

CVE-2026-109618CVE-2026-109619

This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.

When you run the tool from your project folder, it looks for these and lists them.

What it looks for

• php_value / php_flag lines in .htaccess
• .user.ini files that set the same settings
• ini_set('memory_limit', ...) and similar in your PHP code

What to do

• ini_set('memory_limit', ...) puts a limit back, which brings back the risk from CVE-2026-109618. Remove it, or set memory_limit with php_admin_value (that can't be overridden).
• Old or invalid settings in .htaccess, .user.ini, Apache php_value, or fastcgi_param PHP_VALUE in Nginx can print warnings before PHP is ready, which is one path to CVE-2026-109619. Remove the ones you don't need. Hiding warnings with display_errors or @ does not help.
• Fatal errors and timeouts that a visitor can trigger (in uploads, imports, callbacks) are another path. Fix them.

Source: php.net