The PHP Core rule SafeLine shipped on 21 October is not a generic "block all uploads" switch. It is aimed at request features from the known chain behind CVE-2026-109618 and CVE-2026-109619.
Four signs are called out in the rule note. A request that carries PHP_SESSION_UPLOAD_PROGRESS. A PHPSESSID that fits the characteristic pattern. A content type of multipart/form-data. A body that combines abnormal form fields with suspicious content. Any one of those can appear in legitimate software. The rule is about the combination associated with the chain, which is why the first setting is observe, not drop.
That focus follows from CVE-2026-109618, which is about multipart parsing and memory state. Upload and form posts are the traffic you should be able to name in a log: time, source address, site, path, and the rule name PHPCoreRCECVE-2026-109618/109619. The write-up is at the rule discussion.
CVE-2026-109619 is the other half. Worker global state can linger between requests. The WAF rule will not print the worker's memory. It will tell you which HTTP client was sending the chain's request shape at the time a pool misbehaved. Use both logs.
Import the rule from the SafeLine rule library. Set the action to blacklist. Enable observe mode. Review a sample of hits against a known-good upload from your own application. If your application itself sends PHP_SESSION_UPLOAD_PROGRESS on a normal photo upload, you need that fact before you block, not after.
When the hits are probes rather than product traffic, move the rule to an intercept action and keep the event record for the follow-up on disk and credentials.
Does the rule fire on every multipart post?
It is built around the known chain's features, not every form on the internet.
What should a useful hit contain?
Time, source IP, site, path, and the rule name. Those are the fields worth capturing in the event view.
Can I skip observe mode if I trust the signature?
You can, but the published guidance is to observe first so a real upload path is not the thing you discover by outage.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.