This rule provides tentative virtual patching for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), a pre-authentication Remote Code Execution in PHP core: request-owned state survives in worker globals after a fatal error and is consumed by a later request before normal initialization (use after free).

Detection: Blocks multipart requests carrying a PHP_SESSION_UPLOAD_PROGRESS field, with or without a file part: the published exploit chain uses both shapes. Session upload progress is a confirmed producer and consumer of the stale state on both mod_php and FPM, it is enabled by default and does not require the application to call session_start().

The request is inspected in its raw form rather than through the WAF's multipart parser, because a part PHP tolerates but the WAF parser rejects would otherwise hide the progress field.

The rule only covers the default session.upload_progress.name. The INI diagnostic consumer described in the advisory (.htaccess, PHP_VALUE) is not reachable from an HTTP request and cannot be virtually patched. Out-of-memory conditions used as producers are covered by crowdsecurity/vpatch-CVE-2026-109618.

Virtual patching mitigates exploitation attempts, but it does not fix the underlying vulnerability: upgrading PHP to a patched version is always recommended. If you cannot update, set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, then restart every worker.

References

• GHSA-6wmf-4rv5-p3rp — PHP security advisory
• GHSA-w8hw-w9fx-j79w — related OOM corruption advisory (CVE-2026-109618)
• php2shell — Calif
• php2shell — Sansec