This analytic detects suspicious PHP web application upload activity associated with the PHP2Shell exploitation using Cisco Secure Firewall Threat Defense Intrusion Event logs. It targets request patterns indicative of attempts to exhaust server resources through PHP session handling and correlates source (src) and destination (dest) to surface potential targeting of a web application. The finding is titled “Suspicious PHP upload activity from [src] targeting [dest]” and is assigned a risk score (50) to prioritize follow-up. The rule references MITRE ATT&CK technique T1190 (Exploitation of Public-Facing Application) and CVE-2026-109619, providing context for suspected vulnerability exploitation. It relies on the Cisco Secure Firewall Threat Defense Intrusion Event data source and is intended for network-layer detection within security operations, enabling rapid triage and investigation of potentially malicious web traffic.) The analytic supports drilldown views to examine per-source and per-destination results, risk-event history for the last 7 days for the affected destination, and cross-linking to related analytic stories (e.g., Cisco Secure Firewall Threat Defense Analytics, PHP2Shell). Known false positives include approved load testing or unusual multipart uploads, so analysts should adjudicate based on request context and targeted service. If confirmed, responders should review web server access logs, PHP session handling behavior, related application logs, and the CVE-2026-109619 applicability, then take containment and remediation actions as needed.