diff --git a/apps/templates/mbgwp-official-helm.yaml b/apps/templates/mbgwp-official-helm.yaml
index 3701934..b66396d 100644
--- a/apps/templates/mbgwp-official-helm.yaml
+++ b/apps/templates/mbgwp-official-helm.yaml
@@ -16,6 +16,10 @@ spec:
     chart: wordpress
     helm:
       values: |
+        # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618,
+        # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP.
+        replicaCount: 0
+
         # Official WordPress image configuration
         image:
           registry: docker.io
diff --git a/freshrss/freshrss-deployment.yaml b/freshrss/freshrss-deployment.yaml
index 2be5ff2..6517555 100644
--- a/freshrss/freshrss-deployment.yaml
+++ b/freshrss/freshrss-deployment.yaml
@@ -8,7 +8,9 @@ metadata:
     io.kompose.service: freshrss
   name: freshrss
 spec:
-  replicas: 1
+  # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618,
+  # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP.
+  replicas: 0
   selector:
     matchLabels:
       io.kompose.service: freshrss