Set `session.upload_progress.enabled=0` until the next PHP release to block an unlikely RCE vector (CVE-2026-115560).

We already recommended this for CVE-2026-109619 from Wednesday: keep it disabled.

Only applications with non-default `serialize_handler` switching it to `php` at runtime can be affected.

There is more information in the advisory on the PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1

#php