SafeLine: How to Address PHP Core RCE (CVE-2026-109618 and CVE-2026-109619)

About the vulnerabilities

A WAF matches HTTP request indicators. These PHP bugs are in runtime memory management. The two are not at the same layer.

CVE-2026-109618 is, at its core, an out-of-memory condition during multipart parsing. That condition then triggers longjmp and corrupts per-request memory state. Known triggers include a missing usable Content-Length, a single part with a large number of headers, an empty file input, and nested field names. The current rule does not cover these core indicators.
CVE-2026-109619 is a use-after-free caused by leftover worker-global state. Upstream explicitly documents several producer/consumer paths: INI diagnostics, fatal-error backtraces, the session lifecycle, and other extension or object state. Of those, the current rule covers the session upload progress path.
A WAF cannot see state inside the PHP process. It also cannot see traffic that never passes through it, including internal traffic, direct-to-origin requests, CLI, and other non-HTTP attack surface.

About this rule

SafeLine publishes the custom rule below to match request indicators used to probe this vulnerability. It helps you spot likely vulnerability scans and see where those requests come from.

This rule is a virtual patch for a known exploit chain. It is not a root-cause fix for the PHP vulnerability. For chains that have already been reproduced, it can block them once the match is validated. It does not cover every variant or every other attack path, and it is not complete coverage. A full fix requires upgrading PHP. A WAF rule, like any virtual patch, only buys time for that upgrade.

Rule configuration

In the console

In Allow & Deny, set up a deny rule and Enable monitor mode: log attack events without blocking the request. (added in 9.4.3). Matches are logged as attack events and are not blocked.

Condition group 1 (Condition: AND):

POST, enter PHP_SESSION_UPLOAD_PROGRESS, Operator Exist
POST, enter PHPSESSID, Operator Regex Match, value ^[0-9A-Za-z,-]{16,256}$
Req Headers, enter Content-Type, Operator Contains, value multipart/form-data

Click Add AN OR condition
Condition group 2 (Condition: AND):

POST, enter PHP_SESSION_UPLOAD_PROGRESS, Operator Exist
Req Headers, enter Content-Type, Operator Contains, value multipart/form-data
Req Body, operator Regex Match, value: Content-Disposition:\s*form-data;\s*name="[^"]+"\r\n([^\r\n]+\r\n)*\r\n[\s\S]{0,32}\x00

JSON

{
  "name": "PHP Core RCE CVE-2026-109618/109619 - observe",
  "action": 1,
  "monitor": true,
  "log": false,
  "is_enabled": true,
  "insert_position": "first",
  "pattern": [
    [
      {"k": "post_param", "op": "exist", "v": [], "sub_k": "PHP_SESSION_UPLOAD_PROGRESS"},
      {"k": "post_param", "op": "re", "v": ["^[0-9A-Za-z,-]{16,256}$"], "sub_k": "PHPSESSID"},
      {"k": "req_header", "op": "has", "v": ["multipart/form-data"], "sub_k": "Content-Type"}
    ],
    [
      {"k": "post_param", "op": "exist", "v": [], "sub_k": "PHP_SESSION_UPLOAD_PROGRESS"},
      {"k": "req_header", "op": "has", "v": ["multipart/form-data"], "sub_k": "Content-Type"},
      {"k": "req_body", "op": "re", "v": ["Content-Disposition:\\s*form-data;\\s*name=\"[^\"]+\"\\r\\n([^\\r\\n]+\\r\\n)*\\r\\n[\\s\\S]{0,32}\\x00"], "sub_k": ""}
    ]
  ]
}