PHP’s official position is that only a full update is a complete solution. Interim measures that reduce exposure include: rejecting requests whose Content-Type contains multipart/form-data at the web server before they reach PHP (covering all HTTP methods, not just POST); setting memory_limit=-1 to remove the controllable OOM trigger for CVE-2026-109618; and setting session.upload_progress.enabled=0 for CVE-2026-109619. For systems running PHP 8.1 or earlier that cannot be patched or compiled from PHP’s source-backports, the recommended action is isolation from public networks or taking them offline.