PHP dev has said that the claimed session.upload_progress.enabled=Off config mitigation that's floating around is not sufficient to mitigate the upcoming PHP bug, and the only actual fix is patching.