diff --git a/NEWS b/NEWS
index 42ff62143cff..8de799937c57 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
     PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 
+- Session:
+  . Changed default of session.upload_progress.enabled to 0. (jorgsowa)
+
 - SAPI:
   . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
     (Martin Mirchev)
diff --git a/UPGRADING b/UPGRADING
index 2d48a1da05ca..5492b1dd3391 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -178,6 +178,10 @@ PHP 8.6 UPGRADE NOTES
         explicitly set this to "None" (and also set session.cookie_secure
         to 1).
     RFC: https://wiki.php.net/rfc/session_security_defaults
+  . The default of session.upload_progress.enabled is now 0 (was 1). Upload
+    progress tracking writes request data into the session, so it is now
+    opt-in. Applications that read upload progress from $_SESSION must
+    explicitly set this to 1.
   . SessionHandler::validateId() has been added and delegates to the
     configured save handler. A subclass that declares validateId() without
     a return type now emits a deprecation notice for the tentative bool
diff --git a/ext/session/session.c b/ext/session/session.c
index cca448b5a415..590e9d1384eb 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -975,7 +975,7 @@ PHP_INI_BEGIN()
 
 	/* Upload progress */
 	STD_PHP_INI_BOOLEAN("session.upload_progress.enabled",
-	                                                "1",     ZEND_INI_PERDIR, OnUpdateBool,        rfc1867_enabled, php_ps_globals, ps_globals)
+	                                                "0",     ZEND_INI_PERDIR, OnUpdateBool,        rfc1867_enabled, php_ps_globals, ps_globals)
 	STD_PHP_INI_BOOLEAN("session.upload_progress.cleanup",
 	                                                "1",     ZEND_INI_PERDIR, OnUpdateBool,        rfc1867_cleanup, php_ps_globals, ps_globals)
 	STD_PHP_INI_ENTRY("session.upload_progress.prefix",
diff --git a/ext/session/tests/upload_progress_disabled_by_default.phpt b/ext/session/tests/upload_progress_disabled_by_default.phpt
new file mode 100644
index 000000000000..bdbc7045e09b
--- /dev/null
+++ b/ext/session/tests/upload_progress_disabled_by_default.phpt
@@ -0,0 +1,10 @@
+--TEST--
+session.upload_progress.enabled is disabled by default
+--EXTENSIONS--
+session
+--FILE--
+<?php
+var_dump(ini_get('session.upload_progress.enabled'));
+?>
+--EXPECT--
+string(1) "0"
diff --git a/php.ini-development b/php.ini-development
index 8663f1c21de7..e21328fbb626 100644
--- a/php.ini-development
+++ b/php.ini-development
@@ -1445,11 +1445,11 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form="
 ;session.trans_sid_hosts=""
 
 ; Enable upload progress tracking in $_SESSION
-; Default Value: On
-; Development Value: On
-; Production Value: On
+; Default Value: Off
+; Development Value: Off
+; Production Value: Off
 ; https://php.net/session.upload-progress.enabled
-;session.upload_progress.enabled = On
+;session.upload_progress.enabled = Off
 
 ; Cleanup the progress information as soon as all POST data has been read
 ; (i.e. upload completed).
diff --git a/php.ini-production b/php.ini-production
index 497a3774b8ed..56c7fabc08cf 100644
--- a/php.ini-production
+++ b/php.ini-production
@@ -1447,11 +1447,11 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form="
 ;session.trans_sid_hosts=""
 
 ; Enable upload progress tracking in $_SESSION
-; Default Value: On
-; Development Value: On
-; Production Value: On
+; Default Value: Off
+; Development Value: Off
+; Production Value: Off
 ; https://php.net/session.upload-progress.enabled
-;session.upload_progress.enabled = On
+;session.upload_progress.enabled = Off
 
 ; Cleanup the progress information as soon as all POST data has been read
 ; (i.e. upload completed).