diff --git a/Dockerfile.template b/Dockerfile.template
index 220294b08f..416d05ca4a 100644
--- a/Dockerfile.template
+++ b/Dockerfile.template
@@ -1,8 +1,16 @@
 {{
 	def is_alpine:
-		env.variant | index("alpine")
+		env.variant | index("alpine");
+	def php_patch_version:
+		{
+			"8.2": "8.2.35",
+			"8.3": "8.3.36",
+			"8.4": "8.4.27",
+			"8.5": "8.5.12"
+		}[env.phpVersion] // env.phpVersion
 -}}
-FROM php:{{ env.phpVersion }}-{{ env.variant }}
+FROM php:{{ php_patch_version }}-{{ env.variant }}
+
 
 {{ if env.version != "cli" then ( -}}
 # persistent dependencies
@@ -166,6 +174,25 @@ RUN set -eux; \
 		echo 'ignore_repeated_source = Off'; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
+{{ if env.version != "cli" then ( -}}
+
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+{{ if env.phpVersion == "8.5" then ( -}}
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+{{ ) else "" end -}}
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+{{ ) else "" end -}}
 {{ if env.variant == "apache" then ( -}}
 
 RUN set -eux; \
diff --git a/beta/php8.2/apache/Dockerfile b/beta/php8.2/apache/Dockerfile
index a0c0a554b6..c13669585a 100644
--- a/beta/php8.2/apache/Dockerfile
+++ b/beta/php8.2/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.2-apache
+FROM php:8.2.35-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.2/fpm-alpine/Dockerfile b/beta/php8.2/fpm-alpine/Dockerfile
index 493922a4ab..75fba44a60 100644
--- a/beta/php8.2/fpm-alpine/Dockerfile
+++ b/beta/php8.2/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.2-fpm-alpine
+FROM php:8.2.35-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.2/fpm/Dockerfile b/beta/php8.2/fpm/Dockerfile
index 5ac0c6d3bf..d47646003f 100644
--- a/beta/php8.2/fpm/Dockerfile
+++ b/beta/php8.2/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.2-fpm
+FROM php:8.2.35-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.3/apache/Dockerfile b/beta/php8.3/apache/Dockerfile
index d24aeea03e..d61af3213a 100644
--- a/beta/php8.3/apache/Dockerfile
+++ b/beta/php8.3/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.3-apache
+FROM php:8.3.36-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.3/fpm-alpine/Dockerfile b/beta/php8.3/fpm-alpine/Dockerfile
index 20f4429250..7ddd1367c8 100644
--- a/beta/php8.3/fpm-alpine/Dockerfile
+++ b/beta/php8.3/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.3-fpm-alpine
+FROM php:8.3.36-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.3/fpm/Dockerfile b/beta/php8.3/fpm/Dockerfile
index 0d000fa0dc..35ee14aa96 100644
--- a/beta/php8.3/fpm/Dockerfile
+++ b/beta/php8.3/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.3-fpm
+FROM php:8.3.36-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.4/apache/Dockerfile b/beta/php8.4/apache/Dockerfile
index b684ce9296..4b06a26cc7 100644
--- a/beta/php8.4/apache/Dockerfile
+++ b/beta/php8.4/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.4-apache
+FROM php:8.4.27-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.4/fpm-alpine/Dockerfile b/beta/php8.4/fpm-alpine/Dockerfile
index aa0788f196..0e353bb258 100644
--- a/beta/php8.4/fpm-alpine/Dockerfile
+++ b/beta/php8.4/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.4-fpm-alpine
+FROM php:8.4.27-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.4/fpm/Dockerfile b/beta/php8.4/fpm/Dockerfile
index f6f3a904d3..b1b64b0bcf 100644
--- a/beta/php8.4/fpm/Dockerfile
+++ b/beta/php8.4/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.4-fpm
+FROM php:8.4.27-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.5/apache/Dockerfile b/beta/php8.5/apache/Dockerfile
index 26fb3f7f2c..ee626e4914 100644
--- a/beta/php8.5/apache/Dockerfile
+++ b/beta/php8.5/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.5-apache
+FROM php:8.5.12-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/beta/php8.5/fpm-alpine/Dockerfile b/beta/php8.5/fpm-alpine/Dockerfile
index 63a137e525..2b58e7f994 100644
--- a/beta/php8.5/fpm-alpine/Dockerfile
+++ b/beta/php8.5/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.5-fpm-alpine
+FROM php:8.5.12-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/beta/php8.5/fpm/Dockerfile b/beta/php8.5/fpm/Dockerfile
index 57ac73916c..e0a159af1b 100644
--- a/beta/php8.5/fpm/Dockerfile
+++ b/beta/php8.5/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.5-fpm
+FROM php:8.5.12-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.2-beta1'; \
 	sha1='02e78039dde380e0157993bb10e6437a9d7499a4'; \
diff --git a/cli/php8.2/alpine/Dockerfile b/cli/php8.2/alpine/Dockerfile
index cda8c98249..82cbdf83f2 100644
--- a/cli/php8.2/alpine/Dockerfile
+++ b/cli/php8.2/alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.2-alpine
+FROM php:8.2.35-alpine
+
 
 # install wp-cli dependencies
 RUN apk add --no-cache \
diff --git a/cli/php8.3/alpine/Dockerfile b/cli/php8.3/alpine/Dockerfile
index 31fa8dfd09..b00be15bea 100644
--- a/cli/php8.3/alpine/Dockerfile
+++ b/cli/php8.3/alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.3-alpine
+FROM php:8.3.36-alpine
+
 
 # install wp-cli dependencies
 RUN apk add --no-cache \
diff --git a/cli/php8.4/alpine/Dockerfile b/cli/php8.4/alpine/Dockerfile
index c7948b406a..98e67408e8 100644
--- a/cli/php8.4/alpine/Dockerfile
+++ b/cli/php8.4/alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.4-alpine
+FROM php:8.4.27-alpine
+
 
 # install wp-cli dependencies
 RUN apk add --no-cache \
diff --git a/cli/php8.5/alpine/Dockerfile b/cli/php8.5/alpine/Dockerfile
index 147f4bd8a5..a3cd750a0d 100644
--- a/cli/php8.5/alpine/Dockerfile
+++ b/cli/php8.5/alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.5-alpine
+FROM php:8.5.12-alpine
+
 
 # install wp-cli dependencies
 RUN apk add --no-cache \
diff --git a/latest/php8.2/apache/Dockerfile b/latest/php8.2/apache/Dockerfile
index 47b23d6e8b..7f9ca992f3 100644
--- a/latest/php8.2/apache/Dockerfile
+++ b/latest/php8.2/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.2-apache
+FROM php:8.2.35-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.2/fpm-alpine/Dockerfile b/latest/php8.2/fpm-alpine/Dockerfile
index 4b50f07991..34e4d3a78d 100644
--- a/latest/php8.2/fpm-alpine/Dockerfile
+++ b/latest/php8.2/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.2-fpm-alpine
+FROM php:8.2.35-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.2/fpm/Dockerfile b/latest/php8.2/fpm/Dockerfile
index 340f4ea6cb..38900405c3 100644
--- a/latest/php8.2/fpm/Dockerfile
+++ b/latest/php8.2/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.2-fpm
+FROM php:8.2.35-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.3/apache/Dockerfile b/latest/php8.3/apache/Dockerfile
index 10581ef8de..176f59519b 100644
--- a/latest/php8.3/apache/Dockerfile
+++ b/latest/php8.3/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.3-apache
+FROM php:8.3.36-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.3/fpm-alpine/Dockerfile b/latest/php8.3/fpm-alpine/Dockerfile
index c9bebb17d9..445d051472 100644
--- a/latest/php8.3/fpm-alpine/Dockerfile
+++ b/latest/php8.3/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.3-fpm-alpine
+FROM php:8.3.36-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.3/fpm/Dockerfile b/latest/php8.3/fpm/Dockerfile
index 975c8e8d60..55ef99d467 100644
--- a/latest/php8.3/fpm/Dockerfile
+++ b/latest/php8.3/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.3-fpm
+FROM php:8.3.36-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.4/apache/Dockerfile b/latest/php8.4/apache/Dockerfile
index ecdadc2305..787546df39 100644
--- a/latest/php8.4/apache/Dockerfile
+++ b/latest/php8.4/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.4-apache
+FROM php:8.4.27-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.4/fpm-alpine/Dockerfile b/latest/php8.4/fpm-alpine/Dockerfile
index 4593777dd6..2dd4ca9a50 100644
--- a/latest/php8.4/fpm-alpine/Dockerfile
+++ b/latest/php8.4/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.4-fpm-alpine
+FROM php:8.4.27-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.4/fpm/Dockerfile b/latest/php8.4/fpm/Dockerfile
index b0e382b478..57ed8878a1 100644
--- a/latest/php8.4/fpm/Dockerfile
+++ b/latest/php8.4/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.4-fpm
+FROM php:8.4.27-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,19 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.5/apache/Dockerfile b/latest/php8.5/apache/Dockerfile
index 94ee1f6ad1..b1473406eb 100644
--- a/latest/php8.5/apache/Dockerfile
+++ b/latest/php8.5/apache/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.5-apache
+FROM php:8.5.12-apache
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	a2enmod rewrite expires; \
 	\
diff --git a/latest/php8.5/fpm-alpine/Dockerfile b/latest/php8.5/fpm-alpine/Dockerfile
index 85c4652b71..ac746ef7ee 100644
--- a/latest/php8.5/fpm-alpine/Dockerfile
+++ b/latest/php8.5/fpm-alpine/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.5-fpm-alpine
+FROM php:8.5.12-fpm-alpine
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -103,6 +104,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \
diff --git a/latest/php8.5/fpm/Dockerfile b/latest/php8.5/fpm/Dockerfile
index 3e824b4ae4..b6b053c488 100644
--- a/latest/php8.5/fpm/Dockerfile
+++ b/latest/php8.5/fpm/Dockerfile
@@ -4,7 +4,8 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM php:8.5-fpm
+FROM php:8.5.12-fpm
+
 
 # persistent dependencies
 RUN set -eux; \
@@ -108,6 +109,21 @@ RUN set -eux; \
 		echo 'html_errors = Off'; \
 	} > "$PHP_INI_DIR/conf.d/error-logging.ini"
 
+# mitigations for CVE-2026-109618 and CVE-2026-109619
+# https://www.php.net/archive/2026.php#2026-10-21-5
+RUN set -eux; \
+	{ \
+		echo '; Mitigation for CVE-2026-109619 (RCE via stale global state)'; \
+		echo 'session.upload_progress.enabled = 0'; \
+		echo '; Mitigation for CVE-2026-109619 on PHP 8.5'; \
+		echo 'fatal_error_backtraces = 0'; \
+		echo ''; \
+		echo '; Mitigation for CVE-2026-109618 (RCE via OOM corruption)'; \
+		echo 'memory_limit = -1'; \
+		echo 'post_max_size = 32M'; \
+		echo 'upload_max_filesize = 30M'; \
+	} > "$PHP_INI_DIR/conf.d/security-mitigations.ini"
+
 RUN set -eux; \
 	version='7.1.3'; \
 	sha1='491a78c7676b15dffcc69130c6054b8f49228a91'; \