The first thing to know is that that Remi is no longer providing PHP updates via his repository. So as of now, unless things change, your only realistic option is to mitigate this vulnerability by disabling the vulnerable PHP modules and adjusting your PHP settings so that CVE-2026-109619 and CVE-2026-109618 can not be exploited.

How do you do that? The short answer is the ensure that all of these settings are set exactly in your php.ini file, then restart all php-fpm versions, as well as apache, to ensure that all settings are in place.

Note: This could very will negatively affect (i.e. break) your PHP applications, especially your forms and upload forms. But fixing the things that break is a very small price to pay in exchange for a secure server that isn’t easily hacked – which will happen without applying these fixes.

Here are the settings that need to be applied to each of your php.ini files:

session.upload_progress.enabled Off
memory_limit -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_vars = 1000
max_input_nesting_level = 32
max_file_uploads = 10

If you are running just one version of Remi PHP then you’ll find that php.ini version here on your CentOS 7 server:

/var/opt/remi/php[xx]/etc/php.ini

You’ll of course need to replace xx with the PHP version that your servers is running. And if you are running more than one version of PHP you’ll need to ensure that you update each php.ini file. If you miss any then your server is not protected.

And while you are at it, you might as well also check to see if the default php.ini file is in place, and update it here:

/etc/php.ini

Once all of the php.ini settings are in place in every php.ini file then you’ll want to restart each php-fpm as well as apache.

Restart each version of php fpm (replace xx with your versions)

systemctl restart php81-php-fpm
systemctl restart php80-php-fpm
systemctl restart php74-php-fpm
systemctl restart php73-php-fpm
systemctl restart php72-php-fpm
systemctl restart php71-php-fpm
systemctl restart php56-php-fpm

Restart apache:

systemctl restart httpd

That should do it.