Comment by jwitthuhn

Seems like some of the people engaging in "responsible disclosure" were not very responsible and it leaked out.

With that info public they do really need to just release the fix, assuming that tweet is accurate.

edit: Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini