Introduction

On 2026-10-21 the PHP project disclosed PHP2Shell (CVE-2026-109618 / CVE-2026-109619): CVSS v4.0 9.2, unauthenticated remote code execution ( PHP security advisory , CERT-EU Security Advisory 2026-018 ).

As a stopgap until PHP can be upgraded, an AWS Security Blog post published four AWS WAF custom rules: PHP2Shell , Block-Multipart-FormData , Block-Oversize-Body and RateLimit-Posts . The AWS Security Bulletin also points to SizeRestrictions_BODY in AWSManagedRulesCommonRuleSet and to the PHP managed rule group (version 2.3, now the default), which adds protection for CVE-2026-109619.

Classmethod has already tested the AWS Security Blog rules thoroughly on an ALB, including the fact that PHP_SESSION_UPLOAD_PROGRESS placed after the first 8 KB of the body goes through.

This article reproduces that test on both CloudFront and an ALB and verifies what was still open:

How far does raising CloudFront's body inspection limit (16 KB default, 64 KB max) get you?

How does the ALB's Web ACL behind…