many php setups sit behind nginx, caddy, or other webserver with a max body size limit.

anyone following OWASP / similar guidelines was probably okay here (for this particular PoC path), if not using apache/mod_php, i would think.