https://jackalsyn.com/posts/php-up-2026.html Two mitigation vectors for the PHPocalypse. One is easy, an INI parameter, the second is a WAF tweak. This until you can patch, upgrade immediately. If you are on old 5x PHP apps, you’re fucked. Apply the stopgap (best-intel, low-risk, reversible) In php.ini / .user.ini / .htaccess: php.ini [stopgap] session.upload_progress.enabled = Off Reload PHP-FPM or your web server. This closes both paths (session.c:3239). 3. Clamp multipart uploads at the edge The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.