After the HN post came up, one security firm included "session.upload_progress.enabled", "session.use_strict_mode", and "php-fpm" in the SEO tags for their initial disclosure that a vulnerability existed. I imagine this was a good hint. https://web.archive.org/web/20261021005246/https://sansec.io... https://x.com/its5q/status/2112700519261032497