How to disable register_argc_argv in PHP

The PHP setting register_argc_argv determines whether the $argc and $argv variables are automatically registered in the global scope when running PHP scripts. These variables contain command-line arguments, which are typically useful for CLI scripts, but can pose a security risk in web applications with improper variable handling.

To disable register_argc_argv for all apps using a particular PHP version, SSH into your server as root and run the following command.

echo "register_argc_argv = 0" > /etc/php8.4-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php8.3-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php8.2-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php8.1-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php8.0-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php7.4-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php7.3-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php7.2-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php7.1-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php7.0-sp/conf.d/disable_register_argc_argv.ini

echo "register_argc_argv = 0" > /etc/php5.6-sp/conf.d/disable_register_argc_argv.ini

Next, restart PHP.

sudo service php8.4-fpm-sp restart

sudo service php8.3-fpm-sp restart

sudo service php8.2-fpm-sp restart

sudo service php8.1-fpm-sp restart

sudo service php8.0-fpm-sp restart

sudo service php7.4-fpm-sp restart

sudo service php7.3-fpm-sp restart

sudo service php7.2-fpm-sp restart

sudo service php7.1-fpm-sp restart

sudo service php7.0-fpm-sp restart

sudo service php5.6-fpm-sp restart

Finally, verify the setting is disabled.

The above steps should be repeated for each version of PHP where you want to disable register_argc_argv.