# php2shell - ModSecurity rule (defense-in-depth layer, does NOT replace updating PHP).
# Blocks requests containing a field named PHP_SESSION_UPLOAD_PROGRESS, used by the PoC
# to reach the session.upload_progress callback. WAFs parse multipart differently
# from PHP: this is an extra layer, not a silver bullet.
SecRequestBodyAccess On
SecRule ARGS_NAMES "@streq PHP_SESSION_UPLOAD_PROGRESS" \
    "id:1026109618,phase:2,t:none,deny,status:403,log,\
    msg:'php2shell: PHP_SESSION_UPLOAD_PROGRESS field blocked (CVE-2026-109618/109619)'"
# If you changed session.upload_progress.name in php.ini, substitute that name above.