One thing that bit me on a patch like this: reloading php-fpm is not the same as restarting it. A reload lets old workers finish their current requests, so a long lived upload can keep a vulnerable worker serving for minutes after you've called the box patched. For these I restart outright now, and accept the minute of dropped connections as the price.