Security researchers have disclosed two vulnerabilities affecting PHP web runtimes, tracked as CVE-2026-109618 and CVE-2026-109619. The issues were highlighted in a Hacker News post that includes a detection rule for CVE-2026-109619.
The provided rule is a web application firewall (WAF) configuration named PHP2Shell. It is designed to block requests that match a specific pattern. The rule applies only when the HTTP method is POST and when either a PHPSESSID value appears in the cookie keys or request body, or the body contains the string PHP_SESSION_UPLOAD_PROGRESS. When all of these conditions are met, the request is blocked and the activity is recorded in CloudWatch metrics under the name PHP2Shell.
The combination of session-related strings and upload progress parameters reflects the request pattern associated with the exploitation technique the rule targets. PHP's session upload progress feature, when handled in certain ways, can be abused in this manner, which is why the rule inspects both cookies and the request body.
Administrators running PHP-based web applications are advised to review the advisories for both CVE identifiers and to consider deploying or testing the published rule as a compensating control. Applying vendor patches for the affected PHP runtimes remains the primary recommended remediation.
Source: Hacker News · Summarized by HeadlinesBriefing