alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT PHP php2shell Multipart Request without Content-Length (CVE-2026-109618)"; flow:established,to_server; http.content_type; content:"multipart/form-data|3b|"; fast_pattern; http.header_names; content:!"content-length|0d 0a|"; nocase; http.method; content:"POST"; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072553; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence Low, signature_severity Major, updated_at 2026_10_22; target:dest_ip;)