A possible stopgap is going around: turning off session.upload_progress.enabled. To be clear, this hasn’t come from PHP. It’s from posts reacting to the leak, and nothing official ties these vulnerabilities to session upload progress. WordPress doesn’t use this feature, though, so turning it off until you can upgrade is low-risk.
Trellis doesn’t have a variable for this setting, so add it to the PHP-FPM php.ini template at roles/php/templates/php-fpm.ini.j2, under the other session.* lines:
session.upload_progress.enabled = Off
Then provision:
trellis provision --tags php production
Trellis doesn’t reload PHP-FPM when php.ini changes, so on the server, as your admin user, reload it and confirm the setting:
sudo service php8.4-fpm reload
php-fpm8.4 -i | grep upload_progress.enabled
It should show Off. Remove the line once you’ve upgraded PHP.
If you’re behind Cloudflare and your plan supports request body fields in custom rules, you can also block requests that include the upload progress field:
any(http.request.body.form.names[*] == "PHP_SESSION_UPLOAD_PROGRESS") or http.request.body.raw contains "PHP_SESSION_UPLOAD_PROGRESS"