PHP 8.5.11 Pre-RINIT Session Unserialize Code Execution

PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain a pre-RINIT session upload-progress unserialization issue that can invoke magic methods on a preloaded gadget class. The proof of concept seeds a session file using a phpserialize endpoint and triggers decoding through a php...