It looks like the PHP RCE details leaked early, (partially) mitigate with `session.upload_progress.enabled = Off` in php.ini — the complete fix requires updating to the patched PHP build (still unreleased) https://jackalsyn.com/posts/php-up-2026.html