It has a boolean twin, php_flag. In a pool they are written php_value[name] = value and php_flag[name] = on. In Apache with mod_php they are written php_value name value, including in .htaccess, and nginx can pass the same thing with fastcgi_param PHP_VALUE. Because they are applied per request, a script can still change them with ini_set(), unlike the admin forms.
The catch is when they are applied. A per-request setting is processed while the request is being handled, not at startup, and a warning or deprecation notice from it, for example for an invalid or outdated value, can trigger CVE-2026-109619. Settings in php.ini and the pool are applied at startup and do not have that effect.
In October 2026, PHP's advisory and Mattias Geniar listed php_value and php_flag in .htaccess or Apache configuration, and fastcgi_param PHP_VALUE or PHP_ADMIN_VALUE from nginx, as things to move into php.ini or the pool. For the sibling flaw CVE-2026-109618, the interim setting was php_admin_value[memory_limit] = -1, in the admin form so that the application cannot set a limit again.
Search for php_value, php_flag and PHP_VALUE across your Apache, nginx and pool files, move what you still need into php.ini or the pool, delete invalid or deprecated entries, and use the admin forms for settings that must not be changed.