btw you might be able to patch the PHP vuln with session.upload_progress.enabled = off
source: https://x.com/J4ck3LSyN/status/2112703096443097263 (i don't give a fuck about the embargo, i need to defend things)
edit: see boost below, this is not actually enough according to a php core dev
@whitequark The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.