This rule provides tentative virtual patching for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), a pre-authentication Remote Code Execution in PHP core: an out-of-memory error raised while PHP parses request input leaves request memory in an invalid state that the request shutdown then consumes. With Apache mod_php this happens before any application code runs.

Detection: The published exploit sends many empty file controls with deeply nested names: empty file controls do not count towards max_file_uploads, and PHP builds the whole name hierarchy six times for each of them. The rule blocks:

• multipart field names nested 12 levels or deeper, empty file controls included,
• multipart bodies with more than 50 file parts, empty filenames included.

Both thresholds are conservative heuristics rather than measured bounds. Legitimate applications nesting form fields 12 levels deep (for instance deeply nested Drupal paragraphs) or uploading more than 50 files in one request will be blocked.

The file part count is written in SecLang because empty file controls are parsed as plain fields and can only be counted from the multipart part headers, which the rule DSL does not expose. Its alerts are reported as native_rule:2026109617 rather than under this rule's name.

Chunked multipart bodies are not blocked as such, since legitimate streaming clients send them too. They let a body bypass PHP's post_max_size check, but keep the AppSec body size limit action to drop (the default) rather than partial or allow, and keep a sane client_max_body_size on the reverse proxy.

Exploitation of the related CVE-2026-109619 through session upload progress is covered by crowdsecurity/vpatch-CVE-2026-109619.

Virtual patching mitigates exploitation attempts, but it does not fix the underlying vulnerability: upgrading PHP to a patched version is always recommended. If you cannot update, the advisory recommends enforcing memory_limit=-1, keeping post_max_size conservative and reducing max_input_nesting_level.

References

• GHSA-w8hw-w9fx-j79w — PHP security advisory
• GHSA-6wmf-4rv5-p3rp — related state reset advisory (CVE-2026-109619)
• php2shell — Calif
• php2shell — Sansec