You turn the feature off with session.upload_progress.enabled = 0 in php.ini, or with php_admin_flag[session.upload_progress.enabled] = off in a PHP-FPM pool. It is an INI_PERDIR setting, so a running script cannot change it with ini_set().
Where you set it matters as much as the value. PHP says to use php.ini, an FPM pool or server configuration that applies before request parsing, to restart every worker, and not to rely on ini_set() or .user.ini. A lower-level file can undo your change: Vincent Schmalbach tested a .user.ini that set the feature back On, and it beat a php.ini drop-in, while a php_admin_flag in the pool stayed Off. The command-line php.ini is also not necessarily the one the website uses.
For CVE-2026-109619, PHP says that turning it off blocks the confirmed session paths but not other variants. Mattias Geniar tested that with the setting off, a multipart request with the upload progress field no longer created a session file. InMotion Hosting reported that it set the value off for every PHP version on its servers on 20 October, restarted PHP, and asked customers not to turn it back on in a .user.ini, php.ini or .htaccess file.
Set it at server or pool level, restart, and check the value the website sees by calling ini_get on a temporary page, which should return "0", then delete that page. Search your sites for .user.ini and .htaccess files that set it again.