(1) There was a high number of hits between July 11-July 15 (the last timestamp is Jul 15, 2022 @ 00:25:49.807 (all happens on commonswiki, although referer might be a different wiki):
normalized_message:" PHP Warning: fopen(): Filename cannot be empty"

The sample request -
https://en.wikipedia.org/w/api.php?action=centralauthtoken&format=json&origin=https%3A%2F%2Fen.wikipedia.org - will return 403 error ('origin' parameter does not match Origin header ) since origin header is not present among request headers ( the non-authenticated request - https://en.wikipedia.org/w/api.php?action=centralauthtoken&format=json will be fine).

(2) Inserting an image on testwiki wmf.19 will produce a warning

Referrer Policy: Ignoring the less restricted referrer policy “origin-when-cross-origin” for the cross-site request: https://commons.wikimedia.org/w/api.php?action=query&format=json&origin=*&generator=allimages&gaisort=timestamp&gaidir=descending&iiurlheight=200&iiprop=dimensions%7Curl%7Cmediatype%7Cextmetadata%7Ctimestamp%7Cuser&prop=imageinfo&gaiuser=Zilant18&iiurlwidth=400&gailimit=15

and the Console error Image corrupt or truncated. (although Publishing seems to be fine).

In T312888#8086343, @Etonkovidova wrote:

(1) There was a high number of hits between July 11-July 15 […]
normalized_message:" PHP Warning: fopen(): Filename cannot be empty"

This link doesn't work for others. Check Link sharing docs.

The sample request -
https://en.wikipedia.org/w/api.php?action=centralauthtoken&format=json&origin=https%3A%2F%2Fen.wikipedia.org - will return 403 error ('origin' parameter does not match Origin header ) since origin header is not present among request headers ( the non-authenticated request - https://en.wikipedia.org/w/api.php?action=centralauthtoken&format=json will be fine).

This error is not what happened for the error sample requests. Instead, this error is because the request is invalid, due to being different from how the sample requests were made.

• The error was from a POST request (as made by submitting forms, or by JavaScript). These are different from GET requests (as from opening or typing links).
• The error was when requesting to commons.wikimedia.org, not en.wikipedia.org.
• The error was with a request to a domain name other than the current page view. E.g. a request to commons, while viewing a page on enwiki. This is significant as browsers send headers like like Referer and Origin automatically for forms and JavaScript requests. Manually making such a request is not the same. Manually opening links will generally work to reproduce an errors for a page view or special page link, but not for API requests.

Because the request is for a cross-origin feature, but was made manually without any Referer set, our API rejects it (correctly) with a 403 error. (40x are client errors as opposed to server errors).

(2) Inserting an image on testwiki wmf.19 will produce a warning

Referrer Policy: Ignoring the less restricted referrer policy “origin-when-cross-origin” for the cross-site request

This is a verbose message from the browser vendor about the "Referrer Policy", whicih is unrelated to this task or the "origin" API feature. The warning is there because Google incorrectly assumes websites will only want to support the latest Google browser and so (wrongly) encourages through this warning that we drop support for older browsers. Google supports the old and new value, and we set the old value for compatibility, which behaves exactly the same.

https://logstash.wikimedia.org/goto/f313dcc9bf6244bf889e08a758558a94

In T312888#8106940, @Krinkle wrote:

In T312888#8086343, @Etonkovidova wrote:

(1) There was a high number of hits between July 11-July 15 […]
normalized_message:" PHP Warning: fopen(): Filename cannot be empty"

This link doesn't work for others. Check Link sharing docs.

Sorry, this link shows the same info that I mentioned in my comment : the errors stopped on Jul 15, 2022 @ 00:25:49.807

There's uptick of these warnings. In PHP 8 they will be elevated to ValueError exception