Blocking PHP CVE-2026-109618 / 109619 exploit probes in Varnish

1) POST/PUT/PATCH with a form Content-Type and no Content-Length (HTTP/1.1 chunked, or HTTP/2 with no declared length) returns 411 Length Required. CVE-2026-109618 needs a multipart body with no usable declared length.

2) application/x-www-form-urlencoded with Content-Length over 2,097,152 bytes returns 413 Payload Too Large. The public proof of concept uses a field name of about 3.5 MB.

3) Any method outside GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS, PURGE returns 405 Method Not Allowed (scanner noise such as TRACK, PROPFIND and HAAD).

Rules 1 and 2 skip clients in a trusted ACL. Every refusal writes a php2shell: line with std.log.

Add this to default.vcl just above sub vcl_recv. Make sure import std; is at the top, and put your own addresses in the trusted ACL.

# Your own addresses: these skip the body rules.
acl trusted {
    "127.0.0.1";
    "203.0.113.10";      # example: office
}

# php2shell probe filter (CVE-2026-109618 / 109619). Header-only.
sub php2shell_filter {
    if (
        (req.method == "POST" || req.method == "PUT" || req.method == "PATCH") &&
        !(client.ip ~ trusted)
    ) {
        # 1. form body with no usable length (H1 chunked, or H2 unknown length)
        if (
            !req.http.Content-Length &&
            req.http.Content-Type ~ "(?i)^(multipart/form-data|application/x-www-form-urlencoded)"
        ) {
            std.log("php2shell: chunked form body " + req.http.host + req.url + " from " + req.http.X-Forwarded-For);
            return (synth(411, "Length Required"));
        }

        # 2. oversized urlencoded body
        if (
            req.http.Content-Type ~ "(?i)^application/x-www-form-urlencoded" &&
            std.integer(req.http.Content-Length, 0) > 2097152
        ) {
            std.log("php2shell: urlencoded body " + req.http.Content-Length + "B " + req.http.host + req.url + " from " + req.http.X-Forwarded-For);
            return (synth(413, "Payload Too Large"));
        }
    }

    # 3. method allow list: add any method your setup uses (e.g. BAN)
    if (req.method !~ "^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS|PURGE)$") {
        std.log("php2shell: method " + req.method + " " + req.http.host + req.url);
        return (synth(405, "Method Not Allowed"));
    }
}

Then call it in vcl_recv, after any PURGE or BAN handling and before POST requests are passed to the backend:

    call php2shell_filter;

Rule 1 deliberately checks only for a missing Content-Length, not for a Transfer-Encoding: chunked header. HTTP/2 has no such header, so matching on it would miss HTTP/2 attacks.

A Varnish reload is asynchronous, so confirm the new VCL is active afterwards.

varnishd -C -f /etc/varnish/default.vcl >/dev/null && systemctl reload varnish
sleep 10
varnishadm vcl.list | grep ^active

Run these from an address that is not in the trusted ACL. Replace example.com with one of your sites.

# rule 1: chunked form post, expect 411
curl -s -o /dev/null -w '%{http_code}\n' -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Transfer-Encoding: chunked' --data 'a=1' https://example.com/

# rule 2: 3 MB urlencoded post, expect 413
head -c 3000000 /dev/zero | tr '\0' a > /tmp/big.txt
curl -s -o /dev/null -w '%{http_code}\n' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-binary @/tmp/big.txt https://example.com/

# rule 3: odd method, expect 405
curl -s -o /dev/null -w '%{http_code}\n' -X TRACK https://example.com/

# control: a normal small form post should behave exactly as before
curl -s -o /dev/null -w '%{http_code}\n' --data 'a=1' https://example.com/

If a site sits behind a CDN, the CDN may add a Content-Length before the request reaches Varnish, so expect little rule 1 traffic there.

nano -w /etc/systemd/system/varnish-php2shell.service

Contents of which are;

[Unit]
Description=varnishncsa log of requests refused by php2shell_filter
After=varnish.service
Requires=varnish.service

[Service]
Type=simple
ExecStart=/usr/bin/varnishncsa -q 'VCL_Log ~ "php2shell"' -F '%%t %%{X-Forwarded-For}i %%m %%{Host}i%%U%%q %%s cl=%%{Content-Length}i ct="%%{Content-Type}i" ua="%%{User-Agent}i" %%{VSL:VCL_Log}x' -w /var/log/varnish/php2shell.log -a
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=5
User=varnishlog
Group=varnish

[Install]
WantedBy=multi-user.target

Gotcha: in a systemd unit a literal % must be written %%, or the service fails with "Invalid slot". The varnishlog user name varies by distribution: check with id varnishlog.

Log rotation, in /etc/logrotate.d/varnish-php2shell;

/var/log/varnish/php2shell.log {
  weekly
  rotate 12
  missingok
  compress
  delaycompress
  notifempty
  postrotate
    systemctl -q is-active varnish-php2shell.service && systemctl reload varnish-php2shell.service || true
  endscript
}

Enable and watch;

systemctl daemon-reload
systemctl enable --now varnish-php2shell.service
tail -f /var/log/varnish/php2shell.log

Exploit attempts: chunked application/x-www-form-urlencoded POSTs to /wp-admin/admin-ajax.php, a fake desktop browser User-Agent, and a forged 127.0.0.x address at the start of X-Forwarded-For. All refused with 411 by rule 1.

Scanner noise: PROPFIND, TRACK and misspelled methods (e.g. HAAD) aimed at bare server IPs. All 405.

To check for false positives, look at log lines from your own addresses, or browser User-Agents that don't fit the pattern above. A genuine client caught by rule 1 would be something like an API tool streaming a form body without a length: exempt that host or path from rule 1.

The public exploit tool reaches CVE-2026-109619 through PHP's session upload progress, via a PHP_SESSION_UPLOAD_PROGRESS field in a multipart body. Needs the bodyaccess vmod from varnish-modules: add import bodyaccess; at the top of default.vcl, then put this inside the untrusted-POST block, after rule 2.

        # 4. session upload-progress field in a multipart body (bodies up to 1 MB)
        if (
            req.http.Content-Type ~ "(?i)^multipart/form-data" &&
            std.integer(req.http.Content-Length, 0) <= 1048576
        ) {
            if (std.cache_req_body(1MB) &&
                bodyaccess.rematch_req_body("PHP_SESSION_UPLOAD_PROGRESS") > 0) {
                std.log("php2shell: upload_progress field " + req.http.host + req.url + " from " + req.http.X-Forwarded-For);
                return (synth(403, "Forbidden"));
            }
        }

Log-only mode: comment out the return (synth(403, ...)) line. Bodies over 1 MB pass uninspected. Won't compile without varnish-modules.

Delete sub php2shell_filter and the call php2shell_filter; line (or revert the commit if your VCL is in git), then compile and reload as in step 3. Then:

systemctl disable --now varnish-php2shell.service
rm /etc/systemd/system/varnish-php2shell.service /etc/logrotate.d/varnish-php2shell
systemctl daemon-reload

Tested on Varnish 6.6 with varnish-modules 0.18.