This blocks the default PHP session upload-progress field on cPanel until every PHP on the server is on a fixed release. Ordinary uploads do not send this field, so they keep working. If session.upload_progress.name was changed in php.ini, put that name in the rule in place of PHP_SESSION_UPLOAD_PROGRESS.
First, go to: Security Center → ModSecurity™ Tools → Rules List → Add Rule. Paste the code below under Rule Text.
SecRule REQUEST_HEADERS:Content-Type "@rx multipart/form-data" \
"id:2026102101,phase:2,chain,t:lowercase,deny,status:403,log,\
msg:'Blocked PHP session upload-progress field'"
SecRule ARGS_NAMES|FILES_NAMES "@streq PHP_SESSION_UPLOAD_PROGRESS" "t:none"