I've tested the CVEs on PHP 8.5.11 and `session.upload_progress.enabled = Off` definitely increases safety but it doesn't guarantee it. Use of plugins can open up additional exposure.