Context. PHP ships an emergency security release today (14:00 UTC) fixing CVE-2026-109618 and CVE-2026-109619 — two critical (CVSS 9.2) unauthenticated RCE vulnerabilities in session.upload_progress. Sources: PHP.net notice at https://www.php.net/archive/2026.php and the CERT-EU advisory at https://cert.europa.eu/publications/security-advisories/2026-018

Every current PHP build is vulnerable, the feature is enabled by default, and it's reachable via ANY multipart POST to ANY PHP endpoint — no upload form required. Once details go public today, PoCs will follow and every PHP server on the internet gets sprayed.

I wanted early-warning plus edge-blocking that doesn't need ModSecurity or a paid WAF plan, so I wrote a small Cloudflare Worker (free tier, about 6 KB, no KV) and open-sourced it:

https://github.com/codewizdevs/php2shell-watcher

What it does:

• Inspects multipart POST bodies at the Cloudflare edge; all other traffic passes through untouched
• Returns 403 for any request containing the PHP_SESSION_UPLOAD_PROGRESS trigger field — same detection Sansec proposed as a ModSecurity rule (https://sansec.io/research/php2shell), packaged as a Worker
• Heuristics for the leaked PoC shapes (PHPSESSID sent as a form field, t[] heap-spray pattern)
• Discord alert per attempt: IP, country, ASN, CF-Ray, path, user-agent, sanitized body excerpt — deduplicated so a spray doesn't flood your channel
• Monitor-only mode is a one-line config change

What it does NOT do (please read before deploying):

• It does NOT patch anything. Update PHP today, and/or set session.upload_progress.enabled = Off in your php.ini or FPM pool config — that's the real mitigation. This buys time and visibility, nothing more.
• It only sees Cloudflare-routed traffic. If your origin answers directly on its IP, attackers skip the edge — lock the origin down to Cloudflare IPs (https://www.cloudflare.com/ips/).
• Free tier is 100k Worker invocations per day; scope your route to PHP paths (for example /blog/*) on busy sites.

Verify it works (two commands, full proof in the README):

curl -X POST https://your-domain/ -F "PHP_SESSION_UPLOAD_PROGRESS=x" -F "f=@/etc/hostname"

Expected result: HTTP 403 plus a Discord alert containing your own IP.

Deploy is about 5 minutes with wrangler or dashboard paste; MIT licensed. Feedback and issues welcome — and patch your PHP today regardless of whether you use this.