What SafeLine's PHP Core Rule Actually Watches in the Request

Mon, 26 Oct 2026 04:17:15 +0000

The PHP Core rule SafeLine shipped on 21 October is not a generic "block all uploads" switch. It is aimed at request features from the known chain behind CVE-2026-109618 and CVE-2026-109619.

Four signs are called out in the rule note. A request that carries PHP_SESSION_UPLOAD_PROGRESS. A PHPSESSID that fits the characteristic pattern. A content type of multipart/form-data. A body that combines abnormal form fields with suspicious content. Any one of those can appear in legitimate software. The rule is about the combination associated with the chain, which is why the first setting is observe, not drop.

That focus follows from CVE-2026-109618, which is about multipart parsing and memory state. Upload and form posts are the traffic you should be able to name in a log: time, source address, site, path, and the rule name PHPCoreRCECVE-2026-109618/109619. The write-up is at the rule discussion.

CVE-2026-109619 is the other half. Worker global state can linger between requests. The WAF rule will not print the worker's memory. It will tell you which HTTP client was sending the chain's request shape at the time a pool misbehaved. Use both logs.

Import the rule from the SafeLine rule library. Set the action to blacklist. Enable observe mode. Review a sample of hits against a known-good upload from your own application. If your application itself sends PHP_SESSION_UPLOAD_PROGRESS on a normal photo upload, you need that fact before you block, not after.

When the hits are probes rather than product traffic, move the rule to an intercept action and keep the event record for the follow-up on disk and credentials.

Does the rule fire on every multipart post?

It is built around the known chain's features, not every form on the internet.

What should a useful hit contain?

Time, source IP, site, path, and the rule name. Those are the fields worth capturing in the event view.

Can I skip observe mode if I trust the signature?

You can, but the published guidance is to observe first so a real upload path is not the thing you discover by outage.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

What to Inspect After a PHP Core Rule Hit

Mon, 26 Oct 2026 04:17:14 +0000

A SafeLine hit on the PHP Core rule is a starting point, not a closed case. CVE-2026-109618 and CVE-2026-109619 are serious because a crafted request can disturb the runtime or leave worker state behind. If the rule fires, or if the server looks wrong without a clean explanation, widen the search the same day.

Start with the event SafeLine already stored: attack time, source address, site, path, and the rule name. The 21 October rule is documented at the rule page. Match that minute to the web access log and the PHP error log. You are looking for the same client, the same path, and a runtime fault.

Then look at files. Check the web root, the upload directory, and the temporary directory PHP uses for multipart bodies. Look for PHP files that appeared or changed recently and that no deploy can explain. A new file next to an upload endpoint is more interesting than a hit with no file change, but both deserve a note.

Process and network checks come next. Unknown processes, unexpected outbound connections, and cron entries you did not add are reasons to treat the host as suspect. If that bar is met, rotate high-privilege accounts, database accounts, and API keys. Do not rotate everything on the first observe-mode hit from a scanner. Do rotate when logs and files agree that something landed.

Keep the rule in observe until you know your own upload traffic, then move it to block. Upgrade the PHP pool that served the hit. Restart that pool. Confirm the site still logs in and still accepts a normal file. The rule watches the chain. The upgrade removes the bug the chain is aimed at.

What is the minimum record to keep?

Time, source IP, site, path, rule name, and whether a file changed.

Should every hit trigger a credential rotation?

No. Rotate when logs or files show more than a probe.

Does blocking replace the PHP upgrade?

No. Blocking is a control at the proxy. The runtime still has to be patched.