The recent advisory suggested setting session.upload_progress.enabled=0 as a mitigation. The risky path needs an unusual setup (a serialize handler switched at runtime with ini_set()), but the feature is on by default, and most apps never use upload progress tracking.

That made me wonder about defaults in general:

Should features that few apps use, and that have now shown up in a security advisory, be off by default in a future major version?

How would you handle the breaking change for apps that rely on them, with a deprecation cycle, a loud warning, or something else?

Do you audit your own php.ini for features you don’t use, and if so, which ones do you turn off?

I’m not asking about this specific CVE. I’m interested in whether the community thinks “secure by default” should weigh more heavily than backward compatibility in PHP’s configuration.