Since Interworx is a PHP application from pretty much the top down and CVE-2026-109618 and CVE-2026-109619 are actively being exploited due to poor handling of the announcement(s), what guidance do we have from Interworx for temporary and eventually permanent remediation?
I created this here instead of a support ticket because I figured there’s going to be other people impacted since I know I’m not the only customer. 
For reference, for now I have done this in the /etc/php.ini file.
; Enable upload progress tracking in $_SESSION
; Default Value: On
; Development Value: On
; Production Value: On
; https://php.net/session.upload-progress.enabled
session.upload_progress.enabled = Off
I just made a post here because I didn’t see this one. Hopefully they are working on it now!
What does this do?
Also, this would need to be done on each remi ini file as well I assume.
/etc/opt/remi/php##/php.ini
It disables the thing that has the vulnerability in it that is enabled by default. Also, apparently when they released the patch other vulnerabilities were discovered.
And yes, that would need to be disabled in any referenced php.ini
Thank you, Jenna! Always so helpful. 
