Warning: session.upload_progress.enabled must be set to "Off" in your php.ini file to mitigate the PHP vulnerability. All PHP version 5, 7, 8 are affected.
https://xitter.cf/k_firsov/status/2112641845926989944https://xitter.cf/J4ck3LSyN/status/2112703096443097263https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/https://prostack.uk/blog/critical-php-security-update-october-2026/https://www.reddit.com/r/PHP/comments/1xb2utu/upcoming_critical_php_security_release/Reload PHP-FPM (or whatever process manager you're using) after you're done (e.g. sudo systemctl reload php7.3-fpm) to apply changes.
Find your php version with "php -v". Mine is 7.3.x so my php.ini is located in /etc/php/7.3/fpm/php.ini. It may be different for your installation or distro. Search "session.upload_progress.enabled" in that file, uncomment it and set it to Off:
session.upload_progress.enabled = Off
In order to test that it is actually off, create and view a test PHP file like check-progress.php with the below code:
<?php
echo 'session.upload_progress.enabled is: ';
echo ini_get('session.upload_progress.enabled') ? 'On' : 'Off';