diff --git a/docs/content/docs/8.reference/1.environment-variable-specification.md b/docs/content/docs/8.reference/1.environment-variable-specification.md
index a9ea3fd6..08eea1ec 100644
--- a/docs/content/docs/8.reference/1.environment-variable-specification.md
+++ b/docs/content/docs/8.reference/1.environment-variable-specification.md
@@ -128,6 +128,7 @@ Setting environment variables all depends on what method you're using to run you
`PHP_REALPATH_CACHE_TTL`
*Default: "600"*|The duration of time, in seconds for which to cache realpath information for a given file or directory. `600` is the value Symfony's performance guide recommends for applications that open many PHP files. (Symfony docs) (Official docs)|all
`PHP_SESSION_COOKIE_HTTPONLY`
*Default: "On"*|Add the `HttpOnly` flag to the session cookie so browser scripts cannot read it. On by default as recommended by PHP. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (Official docs)|all
`PHP_SESSION_COOKIE_SECURE`
*Default: "false"*|Specifies whether the session cookie should only be sent over HTTPS. Off by default so local development over HTTP works. Set to `true` in production when serving over HTTPS. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (Official docs)|all
+`PHP_SESSION_UPLOAD_PROGRESS_ENABLED`
*Default: "0"*|Track file upload progress in `$_SESSION`. Off by default following PHP's October 23, 2026 security advisory. Set to `1` only if your app reads upload progress from the session and never changes `session.serialize_handler` at runtime. Only applies to native PHP sessions. (Official docs)|all
`PHP_UPLOAD_MAX_FILE_SIZE`
*Default: "100M"*|The maximum size of an uploaded file. (Official docs)|all
`PHP_ZEND_DETECT_UNICODE`
*Default: ""*|Check for BOM (Byte Order Mark) and see if the file contains valid multibyte characters. This detection is performed before processing of __halt_compiler(). Available only in Zend Multibyte mode. (Official docs)|all
`PHP_ZEND_MULTIBYTE`
*Default: "Off"*|Enable or disable Zend Multibyte. (Official docs)|all
diff --git a/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini b/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini
index e8b443c3..17e8bef9 100644
--- a/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini
+++ b/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini
@@ -1547,7 +1547,7 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form="
; Development Value: On
; Production Value: On
; https://php.net/session.upload-progress.enabled
-;session.upload_progress.enabled = On
+session.upload_progress.enabled = ${PHP_SESSION_UPLOAD_PROGRESS_ENABLED}
; Cleanup the progress information as soon as all POST data has been read
; (i.e. upload completed).
diff --git a/src/variations/cli/Dockerfile b/src/variations/cli/Dockerfile
index c83b57a1..70c47a7c 100644
--- a/src/variations/cli/Dockerfile
+++ b/src/variations/cli/Dockerfile
@@ -65,6 +65,7 @@ ENV APP_BASE_DIR=/var/www/html \
PHP_REALPATH_CACHE_TTL="600" \
PHP_SESSION_COOKIE_HTTPONLY="On" \
PHP_SESSION_COOKIE_SECURE=false \
+ PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
PHP_UPLOAD_MAX_FILE_SIZE="100M" \
PHP_ZEND_DETECT_UNICODE="" \
PHP_ZEND_MULTIBYTE="Off" \
diff --git a/src/variations/fpm-apache/Dockerfile b/src/variations/fpm-apache/Dockerfile
index 7847f5b3..1978e983 100644
--- a/src/variations/fpm-apache/Dockerfile
+++ b/src/variations/fpm-apache/Dockerfile
@@ -106,6 +106,7 @@ ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \
PHP_REALPATH_CACHE_TTL="600" \
PHP_SESSION_COOKIE_HTTPONLY="On" \
PHP_SESSION_COOKIE_SECURE=false \
+ PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
PHP_UPLOAD_MAX_FILE_SIZE="100M" \
PHP_ZEND_DETECT_UNICODE="" \
PHP_ZEND_MULTIBYTE="Off" \
diff --git a/src/variations/fpm-nginx/Dockerfile b/src/variations/fpm-nginx/Dockerfile
index 3f50a7b9..a37e7569 100644
--- a/src/variations/fpm-nginx/Dockerfile
+++ b/src/variations/fpm-nginx/Dockerfile
@@ -180,6 +180,7 @@ ENV APP_BASE_DIR=/var/www/html \
PHP_REALPATH_CACHE_TTL="600" \
PHP_SESSION_COOKIE_HTTPONLY="On" \
PHP_SESSION_COOKIE_SECURE=false \
+ PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
PHP_UPLOAD_MAX_FILE_SIZE="100M" \
PHP_ZEND_DETECT_UNICODE="" \
PHP_ZEND_MULTIBYTE="Off" \
diff --git a/src/variations/fpm/Dockerfile b/src/variations/fpm/Dockerfile
index e0e9ec49..720b8662 100644
--- a/src/variations/fpm/Dockerfile
+++ b/src/variations/fpm/Dockerfile
@@ -76,6 +76,7 @@ ENV APP_BASE_DIR=/var/www/html \
PHP_REALPATH_CACHE_TTL="600" \
PHP_SESSION_COOKIE_HTTPONLY="On" \
PHP_SESSION_COOKIE_SECURE=Off \
+ PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
PHP_UPLOAD_MAX_FILE_SIZE="100M" \
PHP_ZEND_DETECT_UNICODE="" \
PHP_ZEND_MULTIBYTE="Off" \
diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile
index c4edbcbb..799d1c71 100644
--- a/src/variations/frankenphp/Dockerfile
+++ b/src/variations/frankenphp/Dockerfile
@@ -2,7 +2,7 @@
ARG BASE_OS_VERSION='trixie'
ARG PHP_VERSION='8.5'
ARG BASE_IMAGE="php:${PHP_VERSION}-zts-${BASE_OS_VERSION}"
-ARG FRANKENPHP_VERSION='1.13.1'
+ARG FRANKENPHP_VERSION='1.13.2'
ARG GOLANG_VERSION='1.27'
########################
@@ -223,6 +223,7 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \
PHP_REALPATH_CACHE_TTL="600" \
PHP_SESSION_COOKIE_HTTPONLY="On" \
PHP_SESSION_COOKIE_SECURE=false \
+ PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \
PHP_UPLOAD_MAX_FILE_SIZE="100M" \
PHP_ZEND_DETECT_UNICODE="" \
PHP_ZEND_MULTIBYTE="Off" \