Temporarily disable PHP session upload progress

.gitea/workflows/container.yml

@@ -77,6 +77,10 @@ jobs:
               httpd -k stop
             '
           docker run --rm --entrypoint php "${IMAGE}:${COMMIT_SHA}" -r '
+            if (ini_get("session.upload_progress.enabled")) {
+                fwrite(STDERR, "PHP session upload progress must be disabled.\n");
+                exit(1);
+            }
             foreach (["exif", "gd", "iconv", "imagick", "intl", "Zend OPcache", "pgsql", "pdo_pgsql"] as $extension) {
                 if (!extension_loaded($extension)) {
                     fwrite(STDERR, "Missing PHP extension: {$extension}\n");

Dockerfile

@@ -29,6 +29,7 @@ RUN sed -i '/mod_mpm_event/ s/^/#/' /etc/httpd/conf/httpd.conf \
 
 COPY opcache.ini /etc/php/conf.d/opcache.ini
 COPY imagick.ini /etc/php/conf.d/imagick.ini
+COPY session-upload-progress.ini /etc/php/conf.d/session-upload-progress.ini
 COPY apache-status.conf /etc/httpd/conf/extra/apache-status.conf
 
 ENTRYPOINT ["httpd", "-DFOREGROUND"]

README.md

@@ -14,6 +14,12 @@ Apache exposes extended `mod_status` data only on pod-local loopback port 8080.
 The Helm chart can add an Apache exporter sidecar, a `ServiceMonitor`, and
 portable alert rules without exposing the detailed status page to the cluster.
 
+PHP session-backed upload progress is temporarily disabled in the image while
+the announced October 2026 PHP security release is pending. This does not
+disable ordinary uploads and is not a substitute for rebuilding with a fixed
+PHP package once Arch publishes it. Verify the installed PHP package in the
+built image before calling a release patched.
+
 ## Continuous integration
 
 The Gitea Actions workflow builds and tests the image on every push. It also

session-upload-progress.ini

@@ -0,0 +1,3 @@
+; Temporary hardening while awaiting the October 2026 PHP security release.
+; These sites do not use PHP's session-backed upload progress tracking.
+session.upload_progress.enabled=Off