Commit 4c6bf5fcce6 for php

commit 4c6bf5fcce68d60a4c82ebc7f799a81b136dea74
Author: Daniel Scherzer <daniel.e.scherzer+phpf@gmail.com>
Date:   Mon Oct 19 13:40:09 2026 -0700

    LiteSpeed: document security considerations for INI overrides (#23806)

    Make it clear that the `alter_ini()` function is indeed meant to be operating
    at the `ZEND_INI_SYSTEM` level, and document in the README file that only
    trusted sources should be granted direct access to the listener.

diff --git a/sapi/litespeed/README.md b/sapi/litespeed/README.md
index 86037732953..3174bb55ad7 100644
--- a/sapi/litespeed/README.md
+++ b/sapi/litespeed/README.md
@@ -76,6 +76,14 @@ have lsphp bind to address 192.168.0.2:3000,

 have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`.

+### INI Security
+
+The lsphp listener must only be reachable by trusted sources, generally just
+the LiteSpeed web front end. Any source that can set its own environment variables
+can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for
+that request. This is the equivalent level of access as the Apache
+`php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter.
+
 ## Using LiteSpeed PHP with LiteSpeed Web Server

 Detailed information about how to configure LiteSpeed web server with PHP
diff --git a/sapi/litespeed/lsapi_main.c b/sapi/litespeed/lsapi_main.c
index 2acbd432ee8..5b7fc3b6c84 100644
--- a/sapi/litespeed/lsapi_main.c
+++ b/sapi/litespeed/lsapi_main.c
@@ -774,6 +774,11 @@ static int lsapi_module_main(int show_source)
 }


+/* The use of `type = ZEND_INI_SYSTEM` when the key starts with `\x01\x04` is
+ * intentional - this is the mechanism by which LiteSpeed communicates the
+ * system-level INI options that should be set. This is only called from
+ * override_ini() with LSAPI_ForeachSpecialEnv(). See README.md in this
+ * directory for more details. */
 static int alter_ini( const char * pKey, int keyLen, const char * pValue, int valLen,
                 void * arg )
 {