# php2shell (CVE-2026-109618 / CVE-2026-109619) - UNOFFICIAL, PROVISIONAL.
# Block multipart POST/PUT/PATCH. lighttpd conditionals do not AND a path-exclusion
# cleanly, so scope this per virtual host / directory that does NOT accept uploads,
# rather than globally. Real fix: update PHP.
$HTTP["request-method"] =~ "^(POST|PUT|PATCH)$" {
    $REQUEST_HEADER["Content-Type"] =~ "(?i)^\s*multipart/form-data([;,[:space:]]|$)" {
        url.access-deny = ( "" )
    }
}