id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	blockedby	blocking
592	CRITICAL: Security recommendations to php.ini	Jeff McKenna	Jeff McKenna	"- related to effort to upgrade PHP through #559
- reported by @netgis:

''The php.ini shipped with 5.2.0 sets display_errors = On and enable_dl = On. 
It leaves session.use_strict_mode, session.cookie_httponly and 
session.upload_progress.enabled at their defaults, and the last one is one 
of the attack paths for CVE-2026-109619. On public servers we switched 
all of these to production values. It might be worth making those the defaults, 
or adding a note to README_INSTALL.''"	defect	new	critical	5.2.1 release	MS4W - PHP	5.2.0			Sven Schroeter TC Haddad		559